our insurer wants to fill in a cybersecurity questionnaire for the policy

Cyber insurers ask for the ten measures of NIS2, not the label

The cyber questionnaire of an insurer usually follows the same structure as the ten measures from Article 21(2) of the NIS2 Directive: risk analysis, incident handling, continuity, supply chain security, vulnerability management, testing, awareness, encryption, access control and MFA. Insurers use this classification because it has become the de facto standard for distinguishing between "basics in order" and "risks unmanaged" — not because the policy imposes a legal NIS2 obligation. Whether the undertaking itself falls under the Directive or the Cybersecurity Act is therefore a separate question from whether the insurer asks about it.

For each of those ten points the insurer wants a concrete answer, not an intention. For risk analysis a dated risk register counts more heavily than a policy document without implementation. For MFA the list often specifically asks about email, VPN and administrative accounts separately — "yes" for the whole company is then too broad. If a measure is missing, then "not yet implemented, planned for [date]" is a more useful answer than a dishonest "yes" or a blank field: insurers more often price on the basis of transparent gaps than on the basis of a perfectly completed list that turns out not to hold up in a claim.

Basis: Article 21(2) NIS2 and Annex A of ISO 27001

The ten measures of Article 21(2) NIS2 form the framework on which virtually every cyber insurer bases his questionnaire, and anyone already ISO/IEC 27001-certified recognises the same categories in Annex A of that standard — with the difference that an ISO certificate adds an independent audit of the implementation, while the insurer himself does not audit anything and relies on the self-reporting in the list.