customer asks about our password policy what should be in it

Password policy falls under access control, not cryptography

A password policy describes how passwords are created, managed and replaced: minimum length and complexity, mandatory change upon suspicion of misuse, prohibition on reuse of old passwords, and the way passwords are stored (hashed, not in plain text). Customers usually ask this as part of access control policy, including management of business assets, not as a separate cryptography issue. This distinction is relevant for which answer you enter: data encryption is about something different than how a user logs in.

What is often missing is not the policy itself, but proof that it is enforced: a technical setting in the identity system (Azure AD, Okta, or similar) that enforces minimum requirements, rather than a document that employees are expected to read. If you do not have that proof, do not enter "yes" to the question of whether the policy is enforced — only to the question of whether policy exists, if that document actually exists. Increasingly, a separate password policy is considered less relevant than the question of multi-factor authentication is mandatory: a strong password with MFA carries more weight in practice than a long password without MFA.

Where that is in the standard and the guideline

ISO/IEC 27001 addresses password management under the control measures for access control in Annex A (authentication information is a separate control there); Directive (EU) 2022/2555 mentions access control and authentication as one of the ten measures of Article 21(2), without prescribing specific password rules — the directive leaves the technical implementation to the organisation. A questionnaire asking for "password policy" thus usually translates one of these two sources into a concrete, testable question.