Is there a process for identifying and remediating vulnerabilities?

Vulnerability management is one of the ten measures

Yes, this is a standard question in every NIS2 questionnaire, because vulnerability policy is listed as a separate component among the ten measures of Article 21(2). A process is expected that systematically identifies vulnerabilities in software, systems and networks — via scans, vendor notifications or threat intelligence — and documents the timeframe within which a patch or workaround will be applied, depending on severity. A single antivirus solution or occasional update is not an answer to this question; the process is what is being asked for, not the tool.

What counts as evidence: a procedure or policy document with scan frequency, patch timeframes per risk class and a responsible function. If that is missing, then "no" or "partly" is the honest answer — a standalone tool configuration without an underlying process is insufficient. Customers often ask this in combination with the question whether there is a procedure for handling security incidents, because a missed patch is often the cause of an incident. Vulnerability management is also sometimes linked to the question whether the effectiveness of measures is tested periodically, because a scanning process without oversight of follow-up is in practice a paper process.

Where this appears in the directive: Article 21(2)

Article 21(2) of Directive (EU) 2022/2555 explicitly names "handling of vulnerabilities" as one of the ten measures among the risk management measures that entities must take. The directive itself does not prescribe a scan frequency or patch timeframe — that level of detail is left to the entity's own risk analysis and, where applicable, to sectoral or national implementation. A questionnaire that asks for a specific number (for example, "critical patches within X days") is testing the customer's own standard, not a NIS2 minimum. When completing the form, pay attention to the distinction between "we have a process" and "we always meet our own deadline" — those are two different answers to two different questions, even if the questionnaire combines them.