customer asks how we secure remote work and BYOD what should I enter

Remote work and BYOD fall under access policy and cryptography

This question usually does not appear as a separate item, but as an elaboration of two of the ten measures from Article 21(2) NIS2: access policy (item i) and cryptography (item h). The customer wants to know how you prevent a private phone or home laptop from becoming a leak to corporate systems. Fill in what you actually have: MDM (mobile device management) on BYOD devices, mandatory disk encryption, a VPN requirement for remote access, and separate profiles for work and private use. If you don't have MDM but do have a technical restriction — for example, corporate data is only accessible via a browser portal without local storage — then that is a valid answer, not a workaround.

If a BYOD policy is completely missing, meaning there is no technical or organizational separation between private and work at all, then "no" is the correct answer. A list without BYOD regulation is not necessarily a problem: under Annex A of ISO/IEC 27001 this falls under control measures for endpoints and access, and many companies mitigate the risk by only allowing remote work via a business device — then there is nothing about BYOD to confirm, but about access control and asset management. Also check whether anything is documented about multi-factor authentication when accessing corporate systems, as this question often appears in the same section and is otherwise answered twice with conflicting answers.

Where this is precisely located: Article 21(2), items h and i

Article 21(2) of Directive (EU) 2022/2555 mentions under h the policy on cryptography and encryption, and under i personnel security, access policy and management of corporate assets — this includes the equipment with which employees gain access, including private phones and home work laptops. In the Cybersecurity Act, the Dutch transposition of this directive, the same ten measures appear; the law comes into force on 15 August 2026. ISO/IEC 27001 Annex A elaborates this further in separate control measures for endpoint equipment, teleworking and access control, which explains why customers sometimes raise this as a single question and sometimes as three separate questions.