the questionnaire asks whether we have a SOC or SIEM, what does that mean

SOC and SIEM are both part of detection and response

SOC stands for security operations center: a team or service that continuously monitors logs and alerts. SIEM stands for security information and event management: the software that collects, correlates and alerts on log data from systems. They often go together — the SIEM is the tool, the SOC is the people using it — but that is not a requirement. A SOC can also work with other tooling, and a SIEM can run without a separate team behind it monitoring 24/7.

If you have neither, "no" is the correct answer, not a workaround. Many customers ask this as an indicator of how mature your detection and response is, not as a requirement in itself. What you can then add: how vulnerabilities and incidents at your organization are still noticed and handled, even without SOC or SIEM — for example via the procedure for handling security incidents and the process for identifying and remediating vulnerabilities. That gives a more realistic picture than a bare "no" without explanation, and it is closer to what the customer actually wants to know.

Where this comes from: Article 21(2) NIS2 and Annex A of ISO 27001

The question usually does not come literally from a standard — neither Article 21(2) of the NIS2 Directive nor Annex A of ISO/IEC 27001 mentions SOC or SIEM as a separate mandatory component. Both require that an organization can detect and respond to security incidents, and a SOC or SIEM is one way to fulfill that, not an end in itself. Customers who fall under the Cybersecurity Act — the Dutch implementation of NIS2, which enters into force on 15 August 2026 — sometimes translate that detection requirement into this concrete question in their own questionnaire, even if the underlying standard does not use the word SIEM.