Is access policy documented, including the management of business assets?

Access policy and asset management are two separate measures

This question often conflates two things: access policy (who may access which systems and which data) and management of business assets, also called asset management (knowing which devices, systems and information carriers you have, and who is responsible for them). In Article 21(2) of the NIS2 Directive, these are two of the ten mandatory measures listed side by side, but they are not synonyms. A customer who poses this as a single question usually wants to know whether you have both in order, not whether they are the same.

For access policy, it is relevant whether there is a procedure for granting and revoking rights, whether that is linked to functions, and whether multi-factor authentication is used for critical systems. For asset management, it is about a current overview of hardware, software and information carriers, including who is the owner of each asset and what happens when equipment is retired or replaced. If you have no formally documented policy but do have a working practice — for example a complete user list in an IAM system, without a policy document attached to it — then "no" to this question is often factually more accurate than a premature "yes". The absence of a document is different from the absence of the measure itself, and that distinction is precisely why this answer usually remains on "to be determined" until you know which evidence the customer expects: a policy document, a screenshot of the rights structure, or a declaration.

Where this is found: Article 21(2) NIS2

Article 21(2) of Directive (EU) 2022/2555 lists access control policy and asset management as separate components within the ten mandatory measures, alongside, amongst others, risk analysis and encryption policy. The directive itself prescribes no fixed format: how an undertaking documents and demonstrates this is up to the undertaking and to what the requesting customer accepts as evidence in its own portal.