customer asks how our office wifi is secured, what do I write there

Wifi question usually falls under access policy, not encryption

A question about office wifi is almost always a sub-question of a broader point: how do you manage access to business resources. WPA2 or WPA3 encryption in itself is not a separate piece of evidence — that is a setting on the access point, not a policy document. What the client actually wants to see is whether guest access is separated from office access, whether the wifi password is changed periodically, and whether a list exists of who is allowed to use which network. That fits under the access policy including management of business assets, not under a separate technical claim about encryption strength.

If you don't have a separate wifi policy, in most cases you can still fill in "yes" if your access policy covers network management as a whole — including who is allowed to connect a new device and how guest accounts work. If the separation between guest network and office network is completely absent, then "no" is the honest answer; a vague explanation about "we use a strong password" will not convince an assessor and is not a substitute for a documented procedure. Also check whether multi-factor authentication plays a role in remote access to the office network — MFA for business systems is often a separate question further down in the same questionnaire and is quite often confused with wifi security.

Where this falls under: Article 21(2) and Annex A

Network security is one of the ten measures in Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555), under the category of security of networks and information systems. In Annex A of ISO/IEC 27001 this falls under the control measures for network security and access management, usually as a separate control point alongside encryption policy. The Dutch Cyber Security Act, which transposes the directive and enters into force on 15 August 2026, follows the same structure — a separate "wifi article" does not exist, it is always an implementation of the broader access or network security point.