questionnaire asks whether laptops are encrypted, how do I know for sure

Disk encryption is part of cryptography policy, not a standalone checkbox

The question about encrypted laptops is a sub-question within the broader policy on cryptography and encryption. Being certain that a laptop is encrypted means in practice: BitLocker (Windows) or FileVault (macOS) is centrally enforced via MDM or Intune policy, not as a loose setting that a user can toggle on or off themselves. The evidence that matters most here is an export from that management environment showing encryption status per device — not a screenshot from a single laptop. If you don't have that export, then "no" or "unknown" is the honest answer; a standalone IT policy document without device data does not answer the question.

Note the distinction that many lists make between "policy" and "enforced": a policy rule stating that encryption is mandatory is different from a technical control that blocks unencrypted devices at login. If your customer asks specifically about "full disk encryption", an encrypted container folder or only an operating system password does not count. This also touches on access policy and management of business assets: without a current inventory of which laptops exist (asset management), you also cannot demonstrate that they are all encrypted — you can only say that the policy exists, not that coverage is one hundred percent.

Where this comes back in NIS2 and ISO 27001

Cryptography is listed as a separate measure in Article 21(2) of the NIS2 Directive, under the policy for the use of cryptography and, where relevant, encryption — one of the ten measures the Directive lists. In ISO/IEC 27001 this falls under the control measures in Annex A that specifically address cryptographic controls. Both frameworks require an established policy plus demonstrable implementation of it; the policy document alone is therefore not sufficient as evidence, technical enforcement counts equally.