customer asks if we use antivirus or endpoint protection

Antivirus falls under vulnerability management, not under cyberhygiene

Antivirus or endpoint protection is a technical measure, and it is best placed under vulnerability management or under access control, not under awareness. Endpoint protection detects and blocks malware on laptops, servers and mobile devices — that is something different from the ten measures as a whole, and customers who ask for this separately usually only want confirmation that an active, up-to-date system runs on all endpoints, not a full description of your architecture.

If the organisation has an endpoint protection solution (Defender for Endpoint, CrowdStrike, Sophos, or equivalent) with central management and automatic updates, "yes" with a brief explanation is the standard answer. If central management is lacking and only standalone consumer antivirus is running, then a firm "yes" is not tenable — a customer who asks further questions often wants to know whether it is part of a broader process for detecting and remediating vulnerabilities, and a standalone antivirus programme without further substantiation does not fully answer that question. If you are in doubt, "no" with an explanation is more honest than a "yes" that does not stand up to audit.

Where this follows from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive explicitly mentions among the ten measures basic practices in the field of cyberhygiene and protection of systems during acquisition, development and maintenance — endpoint protection is regarded as a technical implementation thereof, together with patch management. In ISO/IEC 27001 Annex A this is reflected under the control measures for "protection against malware" and under the broader category of technical security. Customers asking this question on the basis of their own access control, including the management of business assets, usually expect a concrete answer on coverage (which devices) and management (central or not), not a product name.