questionnaire asks whether we classify data according to sensitivity

Classification is part of asset management, not a separate box

Yes, a policy must exist for this, but it rarely stands alone. Data classification by sensitivity (public, internal, confidential, secret) is part of asset management: you can only apply appropriate protection once you know which data carries more weight. Questionnaires that separately ask about "classification of information" often test whether that management goes beyond a spreadsheet list, i.e. whether rules are also attached: who may see what, how is it labelled, what happens to confidential files.

If you have not written this out separately, then "to be determined" is realistic until you check whether it is already implicit in your access policy and asset register If so. Many organisations classify informally — IT knows which systems contain sensitive customer data — without a document "classification scheme" existing. For this question, that is often not enough: the questionnaire wants to see a schema with levels and associated rules, not just an intention.

Traceable to article 21(2) and Annex A

In article 21(2) of the NIS2 Directive, classification does not appear as a separate letter, but is woven into measures on asset management and access policy under points (i) and (d). ISO/IEC 27001 is more explicit: Annex A contains a separate category of control measures for "information classification", with labelling and handling as separate controls. If you already work with an ISO 27001 certificate, this is likely already covered and you can refer to the certificate itself — see whether that certificate is present. Once you fall under the Cybersecurity Act when it takes effect on 15 August 2026, the same obligation runs through the Dutch implementation of article 21; first check whether the organisation actually qualifies as an entity under that directive, as that determines whether this is an obligation or a choice.