questionnaire wants to know which antivirus or endpoint protection we use

Antivirus is part of vulnerability management, not a separate measure

The question about antivirus or endpoint security does not fall under a separate NIS2 measure; it belongs to the broader measure on vulnerability management and cyber hygiene from Article 21(2) of the NIS2 Directive. Endpoint security — antivirus, EDR (endpoint detection and response), or similar software on laptops and servers — is a technical implementation of that requirement, not a separate assessment point. Questionnaires that specifically ask about the product brand (think of Defender, CrowdStrike, Sophos) usually want to know whether endpoint security is running structurally, not which brand exactly.

If the undertaking uses a concrete product, the answer is usually a simple confirmation with possibly the product name. If endpoint security is missing on some systems, or the policy has just been renewed, then "no" or "partially" is the factually correct answer — that is simply the case, and no one needs to justify it. This question often appears in the same questionnaire as the process for identifying and remediating vulnerabilities, because endpoint security and patch management are often assessed together. The question about training in cyberhygiene is also related to this: for many customers, software alone is not enough; they also want to know whether employees know how to use it.

Where this comes from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive lists among the ten measures both "policies and procedures concerning the use of cryptography" and measures for vulnerability management and basic practices in the field of cyber hygiene — endpoint security falls under the latter two. ISO/IEC 27001 Annex A elaborates this further with control measures for protection against malware and for technical vulnerability management. The Dutch Cybersecurity Act, which transposes the Directive and enters into force on 15 August 2026, does not change this classification; it translates the European text into national obligations.