questionnaire asks for security contact person, who should that be at our company

The contact person is a role, not a name on the questionnaire

Enter the person who is internally responsible for security measures, not necessarily the owner or director. In practice, that is the person who is also involved in the process for identifying and remediating vulnerabilities and at the procedure for handling security incidents — often therefore the same person who is the internal point of contact if something goes wrong. At a small company, that is often the entrepreneur or IT manager themselves; at a larger company, a security officer or someone with a comparable job title. More important than the title is that this person is reachable and knows what is going on, because the customer uses this contact especially in the event of an incident or an audit.

Prefer to enter a role or function mailbox rather than a private name, if you can: that prevents the questionnaire from becoming outdated as soon as someone changes position. An address like "security@" or "ciso@" works just as well for the customer as a name, and is more stable. If the organisation does not yet have a separate role for this, it is common to name the person generally responsible for IT or business operations — as long as that person is also truly reachable on the matter, not just by name.

Where this comes from: Article 21 and the role of governance

Article 21(2) of the NIS2 Directive does not mention a contact person as a separate requirement, but the ten measures listed there — including risk management, incident handling and business continuity — do assume that someone carries them internally and is reachable. Customers asking for this are thus essentially testing whether there is a policy for risk analysis and the protection of information systems and whether that policy has an owner. ISO/IEC 27001 elaborates on this more concretely: Annex A contains measures on roles and responsibilities within information security, and a designated contact person is often the visible evidence of that. The Dutch Cybersecurity Act, which transposes the NIS2 Directive and enters into force on 15 August 2026, adds no separate requirement on this point beyond what is already in the Directive.