the questionnaire asks about our policy for mobile devices and laptops

Mobile device policy falls under asset management and access

This question relates to Article 21(2)(d) and (i) of the NIS2 Directive: security in procurement, development and maintenance, and access control policy including business assets. Laptops and phones are "assets" — business equipment on which company data is stored or through which access to systems exists. The customer therefore wants to know whether there is a written policy that regulates: who may use which device, how it is encrypted, what happens in case of loss or theft, and whether private use of business devices (or conversely, BYOD) is permitted and under what conditions.

If no separate "mobile device policy" document exists, that is not necessarily a problem — check whether the essence of it already appears elsewhere: in the access policy including business assets, in an ISO 27001 declaration under Annex A (asset management and mobile device policy are listed there as control measures), or in an IT handbook. If it is completely missing, then "no" is the honest answer — a written policy is different from loose practice without documentation. Encryption of the devices themselves also belongs here; that overlaps with the question about cryptography and encryption, and it is helpful to know what answer has already been given there, so that the two are not contradictory.

Where this comes from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive lists under (i) "personnel security, access control and management of business assets" as one of the ten mandatory measures; mobile devices fall under the last of these. ISO/IEC 27001 elaborates this further in Annex A, with specific control measures for "mobile devices" and "asset management" — an organization with ISO 27001 certification usually has this aspect already documented. The Cybersecurity Act transposes this obligation into Dutch law and enters into force on 15 August 2026; until that date, the Directive itself is the point of reference, not the national law.