why do I have to figure everything out again every year because the questionnaire format is different
The format changes, but the underlying question usually doesn't
That is because each portal builds its own questionnaire, while the underlying information in almost all cases comes from the same fixed set of facts. The question "what is your main office" can be called "primary business location" this year and "site details" next year, but the answer remains the same. the establishment address of the companyThe same applies to the ten measures of Article 21(2) of the NIS2 Directive: one client asks them as open questions, another as a yes/no matrix with reference to Annex A of ISO/IEC 27001, but it concerns the same control measures. Reformulating the question does not change the answer, only the packaging.
Where things do go wrong: some clients ask this year about the basic module of the EFRAG VSME standard, and next year about CSRD indicators that do not align one-to-one with it. This is not a matter of reformulation but of a different underlying question, and then figuring it out again is sometimes unavoidable. The system recognizes per question whether it concerns a known answer or something new, and only fills in what is already established — it marks the rest as new, so you do not have to go blindly through an entire list.
Why the same facts, different fields
This follows from how the sources themselves are structured: the Trade Register Act 2007 establishes a fixed set of data — name, number, address, sector — that each portal can request in its own way without the data itself changing. With the company's registration number and the sector in which the enterprise operates that is most visible: those fields appear in almost every list, only under a different name. With CSRD-related questions (Directive 2022/2464) it is different, because the indicators themselves can be tightened each year.
This answer applies to every type of questionnaire, not only to the cyber questions from your customer, answer it. The full explanation — with the sources, country-specific details and related topics — is on the hub.
This is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.