they ask if our employees log in with a single login to everything

SSO is an authentication measure, not a separate NIS2 requirement

Single sign-on (SSO) does not appear as a separate item in Article 21(2) of the NIS2 Directive. The question belongs under access control policy: how you determine who can access which system, and how you verify this. SSO is a means to that end, not an end in itself — the answer you provide must therefore address what SSO solves in your environment, not the tool itself.

Important to check before you enter "yes": does the questionnaire use "SSO" as a synonym for centralized identity management (one IdP, for example Azure AD or Okta, for most business applications), or is it actually asking for something else that happens to be worded this way? Many formats pose this question as a stepping stone to the follow-up question on multifactor authentication — if you answer "yes" to SSO but do not have MFA set up on the IdP, an auditor will view that as a partial measure. Check this together with the question about multi-factor authentication before you confirm the answer. If you only have SSO on some of your systems — for example on SaaS applications but not on your on-premises legacy environment — a nuanced answer with an explanation is more precise than a plain "yes".

Access control policy and Annex A give the exact reference

The justification runs through two channels. In the NIS2 Directive, authentication falls under the measures in Article 21(2), in particular under point (i), on access controls and management of corporate resources — that is where the broader access control policy is the connection point in your supply chain file. If you work with ISO/IEC 27001, you will find SSO reflected as an implementation of the control measures in Annex A on identity management and authentication (A.5.15 through A.5.18 in the 2022 version). If you have no certificate, that in itself is not a problem for this answer — the question about SSO is separate from the question of whether you are certified. The Dutch Cybersecurity Act, which transposes NIS2 in the Netherlands, adds no separate SSO requirement here; it refers back to the same ten measures in Article 21(2) for implementation.