how do I fill in the question about VPN and secure remote access

The question goes beyond VPN alone

A VPN is one technique, but the question itself is about remote access security as a whole. This falls under point (i) of the ten measures in Article 21(2) NIS2: security of personnel, access policy and management of assets. A customer asking about "secure remote access" usually wants to know whether a VPN or comparable encrypted connection is used, whether multi-factor authentication is mandatory, and whether access is limited to what someone needs for their role. Therefore do not only answer "yes, we use VPN" — add whether that is mandatory for all external access, and whether there is a time limit or automatic logout.

If you do not have a VPN but use another mechanism — a zero-trust solution, a gateway with certificate authentication, a cloud environment without a local network — then "no" to the literal VPN question is not wrong, but incomplete. In that case describe what is actually used, because your customer's portal is actually asking about the objective (encrypted, controlled access), not the specific product. If multi-factor authentication on remote access is missing, that is often a separate question that comes back separately in the list, see is multi-factor authentication used for access to business systems. If you have not documented who may log in remotely and with what rights, that also affects the broader question about access policy, see is the access policy documented, including the management of business assets.

Where that appears in the directive and the standard

Article 21(2)(i) of Directive (EU) 2022/2555 lists security of personnel, access policy and management of assets as one of the ten mandatory measures; remote access falls under this. ISO/IEC 27001 Annex A develops this further with specific control measures for access security and network security, where VPN use is typically documented. The Cybersecurity Act, the Dutch transposition of NIS2, enters into force on 15 August 2026 and establishes the same ten measures for entities falling under the Act.