questionnaire asks about antivirus software or endpoint protection what should I say

Endpoint protection falls under cyber hygiene, not under a separate measure

Antivirus software or endpoint protection is not listed as a separate item in Article 21(2) NIS2. It falls under basic cyber hygiene practices (part g) and vulnerability management (part e). Under ISO 27001 it is included in Annex A under control measures for malware and technical vulnerabilities. Specifically: name the product or type (e.g. EDR with centralized management, or a standard antivirus solution), state whether it is installed on all endpoints — servers, workstations, laptops — and whether updates and scans are enforced centrally or per device.

If endpoint protection is missing from some systems, answer "no" to that question and not "yes, with the exception of". Questionnaires rarely provide room for nuance, and a partial "yes" is indistinguishable from a full "yes" for your customer. If you do have an EDR or antivirus solution but lack supporting documentation such as a configuration overview or vendor statement, that is often the moment to check whether there is a process for identifying and remedying vulnerabilities — endpoint protection and patch management are often covered together in the same question, and the answer to one question cannot be viewed in isolation from the other.

Where this falls under: Article 21(2) and Annex A

Article 21(2) of Directive (EU) 2022/2555 lists under (g) basic cyber hygiene practices as a mandatory part of risk management, and under (e) policies and procedures for vulnerability management — endpoint protection is mentioned in the NIS2 guidance as an example of such a practice. In ISO/IEC 27001 Annex A, protection against malware is listed as a separate control measure, distinct from the broader vulnerability measure. For Dutch enterprises falling under the Cybersecurity Act, the same classification applies as in the NIS2 Directive, because that Act transposes the Directive. If you are uncertain whether your enterprise falls within its scope, that is a separate question you can work through with whether the organisation itself falls under the NIS2 directive — because that determines whether this is a legal obligation for you or merely a question from your customer.