questionnaire asks whether we have drawn up an incident response plan

Incident response plan is one of the ten measures from Article 21

Yes, this is a recognizable component: Article 21(2)(b) of the NIS2 Directive mentions "incident handling" as one of the ten mandatory measures. The customer is not asking here for a vague readiness to do something about a hack at some point, but for a documented procedure: who reports an incident, who assesses the impact, who decides on escalation and communication, and within what timeframe. If that procedure exists and is in writing, this is an affirmative answer with the document as evidence. If it does not exist, or lives only in people's heads, then "no" is the honest answer — a half-hearted "yes" without underlying documentation causes more damage in an audit than a no with an explanation that it is under development.

Note the difference with the question on detection and discovery: an incident response plan concerns what happens after something is identified, not how vulnerabilities are found — the latter belongs to the process for identifying and remediating vulnerabilities. Some questionnaires ask this as a separate question, others combine it with continuity ("how do you restore your service"), which is a different subject and is answered via the question on back-ups and emergency provisions. It is therefore important to keep incident response and continuity as a separate piece of evidence in the chain file, even if they are in one document in practice.

Where that appears in the directive and the standard

Article 21(2)(b) of Directive (EU) 2022/2555 explicitly mentions "incident handling" as a mandatory measure alongside the other nine in that paragraph. In ISO/IEC 27001 this is reflected in Annex A, under the controls on information security incident management — anyone already certified according to ISO 27001 likely has this evidence already. The Cybersecurity Act transposes Article 21 into Dutch rules, but only takes effect on 15 August 2026; until that date the directive itself is the framework to be applied to determine whether this is already in order.