the questionnaire asks whether we use a firewall and antivirus, how do I answer that

Firewall and antivirus are technology, not the answer in itself

A firewall and antivirus are separate technical measures, not a standalone security subject. In the ten measures of Article 21(2) NIS2 and in Annex A of ISO/IEC 27001, they do not appear as a separate item: they are part of a broader set of network and system security measures. If the question stands alone in a list, it is usually a simplified question from a customer who does not use NIS2 language themselves, or an initial screening question before the rest of the list follows.

Answer the question factually: does the company have a firewall and antivirus software active, yes or no. If so, the supply chain file can usually substantiate this with a technical inventory or a configuration overview — no certificate, no statement, only a factual determination. If that documentation is missing, then "no" or "unknown" is the honest answer; a firewall that is in place but is not documented anywhere does not provide evidence with which you can substantiate "yes". Pay attention to the connection with access control and asset management: a firewall without current visibility of connected systems is in practice a half measure, and this often reappears in broader lists as a separate question.

Where this falls within the ten measures

Firewalls and antivirus fall materially under the measures for network and system security from Article 21(2) NIS2, and in ISO 27001 under the technical control measures of Annex A. They are rarely the core of an audit or assessment; more relevant is whether the undertaking periodically assesses whether its security measures remain effective, because a firewall without maintenance or logging counts for little in practice. For an undertaking that is not itself subject to the Cybersecurity Act, this is usually a customer question without legal basis — but the answer remains factually the same.