questionnaire asks if home work stations are secured what do I answer

Home workplaces fall under access control policy, not under a separate theme

There is no separate answer for "working from home" required: the question in practice concerns access management, authentication and the security of end-user devices. If that is in order, working from home is covered. Answer the question therefore by referring to the same measures you already use for office workplaces: who gets access to which systems, with which device and via which connection.

Specifically, the customer is looking for three things: a VPN or other encrypted connection to business systems, multi-factor authentication for external access, and management of the laptops and phones that employees use at home (patch level, disk encryption, password policy). If you have documented that, "yes" can be substantiated. If one of the three is missing — for example, MFA is only mandatory in the office, not when working from home — then the answer is "partly" with an explanation of which part is in place. Check this against access control and asset management and against the status of multi-factor authentication: those are the two dossier documents on which this answer relies. If you have no VPN but another form of encrypted access, name that specifically — "secure" without substantiation does not provide a usable answer.

To be traced back to article 21 paragraph 2, not to a separate working from home standard

NIS2 does not have a separate article on working from home. The ten measures of article 21 paragraph 2 of Directive (EU) 2022/2555 mention access control policy and the management of business assets (section i) and the use of multi-factor authentication or continuous authentication (section j) as separate categories — working from home is an application thereof, not a separate category. In an ISO 27001 implementation, this falls under the Annex A measures for access security and equipment outside the business premises. If the customer asks about "secure home workplaces", the answer is in fact an extract from your broader access control policy, and that is also where you look for the evidence document.