customer asks which antivirus or endpoint protection we use

Antivirus falls under vulnerability management, not under a separate question

Entering a brand name is usually not what the question asks. "Which antivirus do you use" is almost always a translation of a question into measure (i) of Article 21(2) NIS2: policy on vulnerability management and analysis. The customer wants to know whether endpoints are structurally protected against malware and whether that protection remains current — not which logo is on the box. In ISO/IEC 27001 this is reflected in Annex A, under the control measures for protection against malware and for technical vulnerability management.

What the evidence usually needs to show: that endpoint protection is running on all relevant devices, that definitions or detection are automatically updated, and that there is a process to follow up on alerts — not merely that the software is installed. A screenshot of one laptop is not evidence for the entire organisation; an overview from the management console of the endpoint solution, with coverage percentage and update status, is. If that overview is missing, the answer is not "no" but "still to be substantiated" — the chain file will not fill in a yes without a source. This goes together with the process for identifying and remediating vulnerabilitiesas antivirus is one measure within that broader process, not an objective in itself. In some questionnaires the question is framed more broadly and falls more under the policy for risk analysis and the security of information systems; so check the format before you fill it in under the wrong section.

Where that appears in the directive and the standard

Article 21(2) point (i) of Directive (EU) 2022/2555 does not mention "policy and procedures concerning the use of cryptography" here, but does explicitly mention "policy on vulnerability management and analysis" as one of the ten measures; malware protection is the operational implementation thereof. In ISO/IEC 27001 Annex A this is reflected in the control measures for malware protection and for management of technical vulnerabilities. The Cyber Security Act will adopt the ten measures of Article 21 once that Act comes into force.