questionnaire asks which antivirus or endpoint protection we use

Endpoint protection falls under cyber hygiene, not under vulnerability management

The question about which antivirus or endpoint protection is used is a sub-question under the broader cyber hygiene and security training measure from Article 21(2) NIS2. The answer depends purely on what is actually running: if an endpoint protection solution is actively deployed on workstations and servers, "yes" with the supplier name is the answer. Without such a solution, or with only the built-in Windows Defender without central management, the answer is more nuanced — there is basic protection, but no central overview or reporting.

Many customers ask this not to know the brand name, but to check whether there is central management: can infections be detected and isolated, and is there visibility across all endpoints. This also touches on the process for identifying and remediating vulnerabilitiesas endpoint protection is often the first layer that signals a vulnerability before it is exploited. Anyone who enters "yes" here without a centrally managed solution must be able to support that with what is actually in place: standalone antivirus per machine is not a lie, but also not a complete answer to what is usually meant.

Where this falls within the ten measures and in ISO 27001

Article 21(2) NIS2 mentions cyber hygiene and security training as one of the ten measures, without explicitly naming endpoint protection — it is a specific implementation of that measure, just like the broader basic practices that fall under training in cyberhygiene In ISO/IEC 27001 Annex A, malware protection is listed as a separate control measure, separate from the training measure. A customer using ISO 27001 as a reference framework may therefore expect a more precise answer than a customer using only the ten measures of the Cybersecurity Act as a checklist.