the customer asks how we classify sensitive information, what is our answer

Classification of sensitive data falls under asset management and access control

This question relates to the measure for business assets and access from Article 21(2) NIS2: knowing what information you have, how sensitive it is, and who is allowed to access it. A classification scheme itself is not a separate list in Article 21 — it is the practical implementation with which you can substantiate your access control and encryption policies. Customers usually ask this to assess whether you distinguish between public, internal, confidential and strictly confidential information, and whether concrete rules apply to each: who may view it, how is it encrypted, how long is it retained.

If you do not have a formal classification scheme with labels and rules per level, the honest answer is "no" or "partly" — do not state that it exists simply because you informally do make a distinction between sensitive and non-sensitive information. If you work with a scheme but it is not implemented everywhere, indicate that as well; a partially implemented policy is different from an established policy. This connects directly to access control and asset management, because without classification, access based on sensitivity cannot be properly substantiated. If you work with encryption of confidential files, that is the evidence for the encryption policy — link that answer to it in your file.

Where that appears in the directive and the standard

Article 21(2) NIS2 names "policy on risk assessment and the security of information systems" and "policies and procedures concerning the use of cryptography" as two of the ten measures; data classification is the link between them, not a standalone item. In ISO/IEC 27001 this is stated more explicitly: Annex A contains control measures for information classification and for labelling assets according to sensitivity level. If you have an ISO certificate, that is immediately the strongest evidence for this answer — check whether it is in your file via the status of the ISO 27001 certificate. The Cybersecurity Act, the Dutch transposition of NIS2 which enters into force on 15 August 2026, does not change this: the ten measures are included unchanged.