customer asks how we secure remote work, what do I enter there

Remote work falls under access control policy, not under a separate measure

There is no separate point on "remote work" in Article 21(2) of NIS2 or in Annex A of ISO 27001. The question is covered in practice by a combination: access control policy and management of assets, multi-factor authentication, and where applicable encryption for data leaving the corporate network. When your customer asks "how do you secure remote work", this is usually shorthand for: how do you manage access to business systems from a location outside the office, and on which device.

In concrete terms, the assessor looks for three things. One: is access to systems and data from home tied to a managed account, with access control and asset management as documented evidence. Two: is multi-factor authentication mandatory for that access — without MFA, "yes, secured" is usually not a defensible answer, see multi-factor authentication for business systems. Three: is there encryption on the device or connection (VPN, disk encryption) if sensitive data is stored locally. If you have no MFA or no VPN requirement, answer "no" or "partially" — a suggested "yes" without underlying policy is not evidence, it is a guess, and that guess will come back in the audit.

Evidence is the policy document, not a screenshot

The evidence usually requested is the access control policy itself (with the passage on remote work or remote access) plus an export from the identity provider showing MFA enforcement. A screenshot of one laptop is not evidence of the process. Under the Cybersecurity Act — the Dutch transposition effective 15 August 2026 — the same requirement returns via the ten measures of Article 21(2) NIS2; whoever has access control and MFA in order now already has a head start on that obligation. Incidentally, this is separate from the question of whether your own business itself falls under the directive as an entity under NIS2 or the national transposition — that determines whether you must comply, not what you enter here.