questionnaire asks about our password policy how should I answer that

Password policy falls under access control, not authentication separately

Password policy is usually answered together with the broader access policy: who may access which system, how is that granted and revoked, and what requirements apply to passwords themselves. Specifically, this covers minimum length, complexity, mandatory change upon suspicion of misuse, and the prohibition on reusing old passwords. Many portals ask this as a separate question, but in the supply chain file it belongs to access policy, including management of business assets — where you document what policy exists and who is responsible for monitoring it.

If you don't have a separate, documented password policy but do have practical agreements — for example via a password manager or enforced settings in Active Directory — that is often sufficient as justification, provided you can demonstrate it. If any documentation is lacking, then "no" is the honest answer; filling in a suspicion as evidence does not help in an audit. Pay attention to the combination with multi-factor authentication for access to business systems": increasingly more customers ask for this as a supplement to or replacement for a strict password policy, because MFA largely mitigates the risk of a weak password.

Traceable to article 21(2) and Annex A

Password policy is not an independent obligation but an elaboration of the measures surrounding access control. Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555) lists access control and asset management as one of the ten mandatory measures; password policy is the most concrete implementation of this. In Annex A of ISO/IEC 27001 this is reflected under the control measures for access management and authentication information. An organisation that is certified for that standard has password policy almost always already documented as part of the broader access policy.