izpolnjevanje tega vprašalnika o varnosti vsakič vzame preveč časa

Always the same ten topics, in different wording

That's almost always due to one thing: every customer translates the same ten measures from Article 21(2) NIS2 into their own words and their own order. One portal asks "do you have an incident response process", another "describe your procedure for security incidents" — it's the same question as is there a procedure for handling security incidents?. Without one central file, you have to look up that answer ten times a year, in ten different phrasings.

The time isn't spent on answering, it's spent on finding evidence. Which policy document, which version, which certificate — looking that up and reformulating the answer to the format of that specific customer, that's the whole day. Questions about večfaktorska avtentifikacija, about access control and asset management in o security requirements for own suppliers come back in almost every list, just arranged differently. Whoever once documents per question type what the actual answer is and where the evidence is located, only has to recognise which of the ten topics is being referred to afterwards — and that's minutes of work, not a day.

Traceable to the same ten measures

Article 21(2) of Directive (EU) 2022/2555 names the ten measures that almost every security questionnaire — whether from a bank, an insurer or a large customer — directly or indirectly refers back to: from risk management and incident handling to cryptography and access control. Whoever applies ISO/IEC 27001 recognises those same topics in the control measures of Annex A, which explains why a questionnaire on "information security" and one on "NIS2 compliance" for the most part ask about the same facts. The Dutch Cybersecurity Act, which transposes this directive by 15 August 2026, does not change that core structure — the questions that customers are already asking will largely remain the same questions after that date.