the questionnaire asks whether data is encrypted when transmitted and stored

Encryption at rest and in transit, two separate questions

This question usually splits into two parts, and that is precisely why it is often answered incorrectly: encrypted transmission (in transit, for example TLS for data traffic) and encrypted storage (at rest, for example disk encryption or database encryption) are two different technical measures. A "yes" to the entire question is only correct if both apply. If you have TLS 1.2 or higher on all external connections but no encryption at the storage layer, then the answer is split: yes for transit, no or still to be done for rest. Enter it split like that too if your customer's portal has two separate fields — and check that, because many formats do, even if the original list presents it as one question.

The supporting document that fits here is the cryptography policy: a document stating which algorithms and protocols the organization uses, for which data categories, and who decides about them. If you have not documented it but have implemented it technically, the answer to the question itself is often still "yes", but the substantiation that an auditor or customer wants to see is missing. That is the moment to the policy on cryptography and encryption draw it up before you tick the box, not after. Without that policy, "yes, we encrypt" is a technical claim without documented backing.

Where this comes from: Article 21(2) and Annex A

Cryptography and encryption are mentioned as a separate measure in Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555), among the ten measures an entity must take at minimum — it is therefore not a side issue alongside risk analysis or incident response, but its own mandatory category. In ISO/IEC 27001 the same subject appears as a separate control measure in Annex A, separate from the broader access control. Those working towards certification are well advised to look at this alongside the question of whether the organisation is ISO 27001-certified, as an auditor typically assesses encryption as a separate checkpoint, not as a byproduct of something else. The Dutch Cybersecurity Act, which transposes these NIS2 obligations, enters into force on 15 August 2026; until that date the directive itself is the point of reference, not the national law.