we don't have a formal security policy can I still answer yes to the questionnaire

No, not without a document showing the policy

No, filling in "yes" is not possible here, not even if the practice is largely in order. The question about security policy does not ask whether you work safely, but whether it is documented: a document showing who is responsible for what, which measures apply and how often it is reviewed. Without such a document, there is nothing to show when the customer asks further questions or an auditor requests it. Supplia does not suggest yes if the chain file has no source document — and that applies fully here, even if the question itself is recognizable to an experienced filler.

What usually can work: "yes, informal" or "no, in development" with a brief explanation, plus reference to what is actually documented — an access policy, an incident procedure, a supplier contract with security requirements. Many customers appreciate that honesty more than a "yes" that does not hold up on verification. If something is documented but there is no single central document, it is often stronger to refer to the separate components: access control and management of business assets, the procedure for security incidents, and the policy on vulnerabilities. Together these often form the core of what the question actually means, even without it being called "security policy".

Where this follows from the ten measures

Policy for risk analysis and information security is the first of the ten measures in Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555) — see also what a customer means by risk analysis. Anyone falling under the Cybersecurity Act must be able to demonstrate this as soon as that law comes into force. ISO/IEC 27001 also requires documented policy in Annex A as a separate control measure, regardless of whether the organization itself is certified.