they want to know how we secure working from home

Remote working security falls under access control and MFA

Questions about remote work locations are usually not a separate topic, but an elaboration of two broader measures from Article 21(2) NIS2: access policy (under e, "policies and procedures concerning the use of cryptography" sometimes also applies as a question about VPN encryption) and authentication (under j, multi-factor authentication and secure communication). Customers want to know concretely whether a remote work location is secured as well as an office location: is a VPN or zero-trust access mandatory, is MFA enabled for all external connections, and is there a policy on which devices (company laptop versus private phone) are allowed access.

If you have not documented that explicitly, the most honest answer is "no" with an explanation: for example, that access to company systems runs through MFA anyway, regardless of the employee's location. That is often stronger than a half-completed "yes" about a remote work policy that does not exist. First check whether multi-factor authentication for business systems has already been documented — if that answer is "yes", that already covers a large part of this question, because most customers ask about remote working precisely to verify that access is properly managed independently of location. If both VPN policy and MFA are missing, then the answer "no" is obvious, possibly with an explanation of what does exist (for example, only a password policy).

Where this becomes more concrete in Annex A of ISO 27001

ISO/IEC 27001 Annex A elaborates this further under the control measures for "remote working" and access control, and many questionnaires from banks and large customers are directly based on that Annex A structure — which is why the question often stands separately from the NIS2 list. Whether an undertaking can say something structured about this depends also on whether it will itself fall under the Cybersecurity Act; if that is not the case, a pragmatic answer about the existing situation is sufficient. If you are unsure whether the undertaking falls under this, check at whether the undertaking falls under NIS2 or its national implementation — that determines how much weight this answer must carry in the overall picture of the list.