questionnaire asks about policy for mobile devices and laptops of employees

Mobile device policy falls under access control and asset management

This question relates to Article 21(2)(i) of NIS2: policy for access control, including management of assets ("asset management"). Mobile phones and laptops are assets that expose data outside the office network, and the customer wants to know whether there is control over this. In practice, the questionnaire typically expects answers to a few fixed points: is there a register of issued devices, is encryption of storage mandatory, is there a minimum PIN or biometric requirement, and can a lost or stolen device be wiped remotely (MDM — mobile device management). BYOD (bring your own device, employees' personal devices) also often comes up separately, because it poses a different risk than corporate devices.

If this policy is not yet documented but the practice is in order — encryption is on by default, access runs through an account with multi-factor authentication — then "no, not yet a documented policy" is the honest answer, with possibly an explanation of the actual measures in place. Do not say "yes" to a question about an MDM solution if you do not have one; a customer who then asks further about the device register or the incident process for loss will otherwise be left without substantiation. Loss or theft of a device also affects the procedure for security incidents, so those two answers must align.

Where this is found: Article 21(2) and Annex A

Article 21(2)(i) of Directive (EU) 2022/2555 lists policy on access control and management of assets as one of the ten mandatory measures. ISO/IEC 27001 elaborates this further in Annex A, under the control measures for "endpoint devices" and mobile equipment; those already ISO 27001-certified typically already have this part documented. The Dutch Cybersecurity Act, which transposes NIS2 and enters into force on 15 August 2026, follows the same structure of ten measures.