questionnaire asks whether our network is segmented, what does that mean

Network segmentation falls under access policy, not under a separate measure

Network segmentation itself does not appear as a separate term in Article 21(2) of NIS2. It falls under the broader measure of access control and systems security — the same category where also access control and asset management falls under. In practice, a customer is asking with this: if someone enters via the guest network or through a compromised printer, can they just access the production environment or HR systems? Segmentation means that the network is divided into separate zones, with their own access rules between those zones.

If segmentation exists, the evidence is usually a network diagram or a short description of the zones (office, production, guest, DMZ) and the rules between those zones — often documented in a firewall configuration or in the access policy itself. If there is no formal segmentation but there is a practical separation — for example a separate wifi network for guests without access to internal systems — that is often already sufficient to answer the question with an explanation instead of a plain "no". Doubt mainly exists with smaller networks without VLANs or zones: then the answer is usually "no" or "partial", and there is no problem filling it in that way.

Traceable to Annex A of ISO 27001 and Article 21(2) NIS2

If an organization is ISO 27001 certified, it has usually already implemented segmentation through the control measures in Annex A on network security; if that is not the case, then the question can be traced back to the ten measures of Article 21(2) NIS2, which will also apply to the Dutch market through the Cyber Security Act. For completeness: whether the organization itself falls under NIS2 or the national transposition is a separate question — segmentation can also be relevant without that obligation, simply because a customer assesses it as a supplier risk.