they ask if our business network is segmented into divisions

Network segmentation is part of access control policy, not cryptography

Segmentation is usually placed in practice under access control and asset management measures, not under a separate heading. The question tests whether you have divided your network into zones — for example office automation, production environment, guest network and OT separated from each other — so that an infection in one segment does not automatically spread to another. Concrete evidence is a network diagram with VLANs or subnets, firewall rules that restrict traffic between segments, and a brief explanation of the design principle (for example "flat network" versus "zone-based"). If that exists, "yes" with that diagram as evidence is a defensible answer.

If segmentation is missing, or if the network is largely flat with only a few VLANs for appearance, then "no" with a brief explanation is more honest than a "yes" that will not hold up under audit. If you are in doubt whether your own answer on access control and asset management already includes segmentation — often that is combined in one answer, because asset inventory is the basis on which you draw segmentation boundaries. Also relevant is whether segmentation is specifically mentioned in your policy for risk analysis, because that is usually where the reason why certain systems are separate is explained.

Where this is in the ten measures

Network segmentation is not a separate point in Article 21(2) of the NIS2 Directive, but is implicitly covered there by the measures for access control (item i) and asset management within risk management (item a). In ISO/IEC 27001 Annex A it can be found explicitly under the security control measures for network security, where segmentation is named as a control measure to separate networks based on trust level. If you yourself fall under the Cybersecurity Act as an entity that falls under the NIS2 Directive or the national implementation then segmentation is usually part of the risk assessment you have to document anyway.