questionnaire asks whether we have a business continuity plan

BCP is the implementation of Article 21(2)(c)

A business continuity plan is the answer to the question of how service delivery continues in case of outage, and that is exactly what Article 21(2)(c) of NIS2 asks for: continuity management, with back-ups, disaster recovery and crisis management. If you have a BCP, you can usually fill in "yes" — but then the document must actually cover those three components, not just a back-up schedule. A copy of the back-up policy alone is usually not sufficient as evidence; the questionnaire asks for the recovery plan, not the technology behind it. Therefore check whether the back-up and emergency provisions your customer means align with what you have actually documented.

If you do not have a separate BCP document but do have working back-ups and an informal agreement on who does what in case of outage, then "no" with an explanation is more honest than "yes" with a partially matching document. In practice, many customers accept an ISO 27001 certificate as substitute evidence for this entire section, because continuity is part of Annex A. Is that the case for you, then refer to the ISO 27001 certificate as general evidence instead of constructing a BCP that does not exist.

Where this is stated: Article 21(2)(c) and Annex A.5.29/5.30

Article 21(2) of the NIS2 Directive lists ten categories of measures that are mandatory under the Directive for the entities affected by it; sub (c) is specifically continuity management, with back-up management, disaster recovery and crisis management as the named components. In ISO/IEC 27001, this is reflected in Annex A, under the control measures for information security in case of disruptions (business continuity) and the associated back-up measure. The Dutch Cybersecurity Act transposes this requirement into national law and is expected to enter into force on 15 August 2026; until that date, NIS2 itself is the source for the content of the requirement.