do I need to send our response plan as a document to the customer

Usually not the entire document, but the core information

No, in most cases you do not need to submit the complete incident response plan as an attachment. Portals that ask about incident response — part of the procedure for handling security incidents — typically want to know or whether a procedure exists, who is responsible, and within what timeframe an incident is escalated and reported. These are questions you answer with a yes/no and a brief explanation, not with the full playbook including contact trees and system names.

There are two situations where an attachment is requested: if the customer has explicitly stated "upload your incident response plan" as the question type, or if it is an audit questionnaire that requires supporting documents. In such cases, a summary version — one page with scope, roles, notification deadlines and escalation paths, without sensitive technical details — is often sufficient. Whether a full plan or a summary is needed is evident from the question text itself; if it says "describe" rather than "upload", a textual answer is more appropriate than an attachment.

Why this distinction exists: Article 21(2) NIS2

Article 21(2) of the NIS2 Directive lists incident handling as one of the ten mandatory measures, but does not prescribe a document format — the Directive calls for a process, not a specific upload format. ISO/IEC 27001 Annex A elaborates this into control measures around response and recovery, and you see the same pattern there: the standard tests whether the process exists and works, not whether there is one clearly defined document called an "incident response plan". This explains why most portals are satisfied with a description in the answer field, and why an attachment is only needed if the question explicitly requires it. If you have not yet documented the process, it is often easier to the policy for risk analysis and information security put it in order first — incident response typically builds on that.