the questionnaire asks who within our company is responsible for cybersecurity

Governance and accountability, not just a name

The question goes beyond entering a contact person. Article 21(2) of the NIS2 Directive mentions "policy on risk analysis and security of information systems" as one of the ten mandatory measures, and governance — who decides, who approves, who bears responsibility — is part of that. Under ISO/IEC 27001 this appears in Annex A, under the control measures for organisation of information security: there it is expected that roles and responsibilities are assigned and documented, not merely agreed verbally. Merely naming a person without a documented role is therefore usually an incomplete answer.

What the client specifically wants to see varies by format: sometimes it is a job title (CISO, IT manager, director), sometimes a RACI-type table, sometimes only the question of whether there IS an appointed person at all. If the company has no formally appointed person responsible but the task actually lies with someone, that is often sufficient for a "yes" — provided it is documented somewhere, for example in a job description or meeting minutes. Without any documentation, "no" is the honest answer; the chain file cannot resolve that by making up a claim. This question is often linked to policy for risk analysis and security of information systems, because a client asking about governance usually also wants to know who established that policy.

Where this appears in the Directive and the standard

The reference to governance and responsibilities is found in Article 21(2)(a) of the NIS2 Directive (policy on risk analysis and information security) and in Annex A of ISO/IEC 27001, under the organisational control measures. In the Netherlands the same obligation reappears through the Cybersecurity Act, which enters into force on 15 August 2026 as transposition of NIS2. Supervisory authorities and clients asking this question are implicitly also testing whether there is a process behind it — which is why this question in practice often runs alongside the question of whether the effectiveness of measures is tested periodically, because a person responsible without a testing moment is worth little on paper.