customer asks about our mobile device policy, what do I enter there

Mobile device policy falls under access policy, not under a separate theme

This falls under Article 21(2)(d) and (i) of NIS2: access control and management of business assets ("asset management"), and in ISO 27001 under Annex A in the assets and access control category. There is no separate NIS2 measure for "mobile phones" — the customer translates their own ISO or BIO questionnaire into this section, and your answer should connect logically to it rather than standing as a separate policy document.

In practice: if an MDM solution is running (Intune, Jamf, or similar), with mandatory screen lock, encryption and remote wipe on loss, then that is the evidence — a screenshot of the policy configuration or the policy document itself. With BYOD (employees' own phones for work), the question is often more sharply formulated, because the separation between business and private data is then the focus: containerization or a separate work app often suffices as an answer. If formal policy is absent but the individual measures are in place (MFA, encryption, wipe capability), then "no" to the question about a documented policy is actually more accurate than a premature "yes" — the customer often asks for the document, not the practice. Also check whether multi-factor authentication for business systems has already been answered, because those two answers must not contradict each other.

Where this usually appears in the questionnaire

Questionnaires asking about mobile device policy often group it together with questions about encryption of end devices — see the policy on cryptography and encryption for the broader encryption question that usually appears there — and with the broader asset inventory from the access policy. In ISO 27001 Annex A, mobile devices do not appear as a separate chapter but as a sub-section of asset management and access control; anyone who has already documented the answer there can link the mobile device answer directly to it instead of inventing a new policy document.