questionnaire asks what our password policy looks like

Password policy falls under access control, not cryptography

The question about password policy belongs with access control: who may access which system, and how is that controlled. Customers usually ask this as a separate question, but in the chain file it belongs under access control and asset management, not under encryption. Do not confuse them: some questionnaires place "password policy" and "encryption" by mistake in the same section, but they are two different measures from Article 21(2) NIS2 — access control (under h) and cryptography (under h is broader, encryption sits separately under the organisational measures of that paragraph).

Concrete requested evidence is usually: a minimum password length, a change frequency or the absence of it (newer practice sometimes advises against periodic changes), and whether a password manager or single sign-on is used. If you do not have a separate documented password policy but do have an access policy in which this is included, that is often sufficient as underlying evidence — the answer depends on how strictly the question is formulated. If password policy is completely missing and there is also no multi-factor authentication as a compensating measure, then "no" with a brief explanation is more honest than a "yes" that you cannot substantiate.

Where that appears in the directive and the standard

Article 21(2) of Directive (EU) 2022/2555 lists access control policy as one of the ten mandatory measures for entities falling under the directive; password management is a standard component of it. In ISO/IEC 27001 this is elaborated in Annex A, under the control measures for access control. For Dutch practice, the directive itself counts for now, because the Cybersecurity Act as its transposition enters into force on 15 August 2026. If you are unsure whether your organisation falls independently within this scope, that is a separate question which you answer separately at whether the organisation itself falls under the NIS2 directive.