what do I enter for the question about encryption of data at rest and in transit

Encryption at rest and in transit are two checkboxes, not one

Fill in separately whether data-at-rest is encrypted and whether data-in-transit is encrypted — a list that makes one question out of it usually still wants to see both answers in the explanation. For transport, TLS 1.2 or higher is the standard expectation; for storage, AES-256 at database level or full disk encryption. If you only have TLS for traffic but no encryption on storage, fill in "partial" or "no" for storage with a brief explanation — not "yes" because the transport side is correct.

If you have not documented this per system but do know that your cloud provider (AWS, Azure, Google Cloud) does this by default at infrastructure level, that is a valid answer, provided you describe it as such: encryption by the provider, not self-managed. Some lists explicitly ask about key management — who manages the encryption keys, you or the provider — and that is a different answer than the question of whether encryption is in place. In case of doubt about what is being asked exactly: check whether the question is part of a broader block on cryptography and encryption, because then policy itself is often also being asked about, not just the technique. If you have no documented policy but do have the technique enabled, indicate that difference in the explanation instead of answering around it.

Where this comes from: Article 21(2) NIS2 and Annex A of ISO 27001

Cryptography and encryption are listed as a separate measure in Article 21(2) of Directive (EU) 2022/2555 (NIS2), alongside measures on access control and network security — which is why customers ask about this separately from for example access control and asset management. In ISO/IEC 27001, cryptography is a separate control measure in Annex A, apart from measures on information systems in general. The Dutch Cybersecurity Act, the Netherlands' implementation of NIS2, is expected to enter into force on 15 August 2026; until then the directive itself is the reference for those already receiving questionnaires on this.