questionnaire asks whether we are insured against cyber incidents

Cyber insurance is not a replacement for measures, but a separate question

Cyber insurance is separate from the ten measures in Article 21(2) of NIS2 and separate from Annex A of ISO/IEC 27001. The question of whether you are insured against cyber incidents concerns financial coverage after an incident, not the quality of your security beforehand. Some customers ask this as a separate question, others use it as an indirect test: an insurer typically does not accept a policy without minimum baseline measures in place, so "yes, insured" is sometimes read as implicit evidence of a certain level of maturity. That is an assumption by the asking party, not a standard from the cited sources.

If you have a policy, the answer can be supported with "yes" once you have the policy or insurance certificate as proof. If you do not have a policy, then "no" is the factually correct answer — a follow-up question about compensating measures is usually asked separately, for example about the procedure for handling security incidents or about back-ups and contingency provisions for recovery. If you are uncertain whether the question concerns the policy itself or the underlying coverage (for example, coverage for ransomware versus business interruption), read the question text literally: "insured against cyber incidents" is broader than "cyber insurance taken out", and the supply chain file must cover the answer to the question asked, not to a related question.

None of the three sources mandates cyber insurance

Neither NIS2 Article 21(2), nor Annex A of ISO/IEC 27001, nor the Cybersecurity Act mentions an insurance requirement. The ten measures of NIS2 concern risk management, incident handling, business continuity and the like — insurance does not feature in them. Annex A likewise does not include a control measure that specifically requires insurance. A customer who asks about insurance is therefore doing so on their own initiative, apart from this legislation; the answer therefore remains a factual yes/no question with a policy as proof, not a compliance question with a legal minimum threshold.