questionnaire asks about network segmentation what does that mean and what do I fill in

Segmentation falls under access policy, not cryptography

Network segmentation means that the corporate network is divided into separate parts, so that an intruder who enters one part cannot automatically access the rest. Think of a separate segment for office automation, a separate segment for production systems (OT), and a separate segment for guest wifi. The question usually appears in the section on access control, not in cryptography or continuity — logically so, because segmentation is fundamentally a form of access control at the network level.

If you have not implemented this, then "no" is the honest answer — there is no middle ground that feels proper but is factually incorrect. If you have implemented it, but only "implicitly" via VLANs without documented policy, fill in what actually exists: a technical measure without a policy document is different from a measure backed by a policy document. Customers who ask this often ask in the same breath about access control and asset management — segmentation is the network-technical equivalent of that. If you are uncertain whether you should share your network diagram or firewall rules as evidence, use the confidentiality button instead of weighing this yourself.

Where that appears in the ten measures

Network segmentation falls under the measures for access control and security of network and information systems under Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555) — that article lists ten categories of measures, including access control policies and the security of systems in acquisition, development and maintenance. In ISO/IEC 27001, segmentation appears in Annex A, under the control measures for network security. For companies that will themselves fall under the Cybersecurity Act — the Dutch transposition of NIS2, which enters into force on 15 August 2026 — this will become one of the ten mandatory measures; anyone who is now uncertain whether this applies to their own enterprise can verify this with the question of whether the enterprise as an entity falls under NIS2.