how do I fill in the question about security when working from home

Remote work falls under access policy and MFA, not under a separate section

The question about remote work is usually not a standalone topic, but an elaboration of two of the ten measures from Article 21(2) NIS2: access policy (section i) and the use of multi-factor authentication or equivalent secured connections (section j). Do not complete it separately, but consistently with what you have already answered for access control and asset management and at the question about multi-factor authentication. If the answer there does not match what you are saying here, that is the first thing an assessor will notice.

Specifically, the client usually wants to know: do employees log in via a VPN or zero-trust connection, is MFA mandatory on that connection, is there a device policy for private versus business laptops, and is there a basic rule about public wifi. If you do not have this as a separate policy document but as a section in a broader ICT regulations document, that is sufficient evidence — cite the section, not the entire document. If one of the four points is missing, do not automatically answer "no": indicate what is in place (for example MFA yes, device policy no) and let the client assess the follow-up question themselves. If you have neither, then "no, not yet formalized" is factually more accurate than a partial "yes" that you cannot substantiate.

Where this comes from: Article 21(2), sections i and j

Article 21(2) NIS2 states under i "policies and procedures concerning the use of cryptography" — no, that is section h; section i concerns personnel security, access control and asset management, and section j specifically the use of multi-factor authentication or continuous authentication solutions, encrypted communications and secure emergency communications within the entity. ISO/IEC 27001 Annex A elaborates on this further under the controls for remote working and network access. The Dutch Cybersecurity Act will adopt this structure unchanged when it enters into force on 15 August 2026, so an answer that already aligns with these two sections now will remain usable after that date.