insurer wants to fill in questionnaire for cyber insurance how do I tackle that

Cyber policy questionnaires follow the same ten measures

The questionnaire of an insurer covers almost always the same area as a NIS2 questionnaire of a customer: access control, MFA, back-ups, patch policy, incident response. This is no accident — insurers base their acceptance questions nowadays largely on the ten measures of Article 21(2) of the NIS2 Directive, and on the Annex A control measures of ISO/IEC 27001. Whoever has already completed those two frameworks for a customer can transfer the answers almost unchanged for the insurer. The difference lies in the tone: a customer asks about policy, an insurer often asks somewhat more specifically — for example whether MFA is mandatory for all administrator accounts, not just "present".

Therefore, first supplement the supply chain file on the points where the insurer goes deeper than usual: multi-factor authentication for business systems, the procedure for handling security incidents and the back-up and recovery provision. Insurers also regularly ask about the patch process; that answer is under the process for vulnerabilities. If the undertaking does not have an ISO 27001 certificate, that is usually not a problem in itself — insurers generally also accept a description of the measures without a certificate, as long as the answers are concrete and do not merely say "yes, we have a policy".

Why these two frameworks overlap

The overlap is substantive, not accidental: Article 21(2) NIS2 lists ten categories of measures (risk analysis, incident handling, business continuity, supply chain security, vulnerability policy, cryptography, access control, MFA, training, and testing of effectiveness), and Annex A of ISO/IEC 27001 develops almost the same topics into testable control measures. Insurers use those frameworks as an objective benchmark because they are externally documented and verifiable — not because the insurer itself falls under the Cybersecurity Act or requires that of the customer.