questionnaire asks whether employees work via VPN, how do I substantiate that

VPN is a technical measure, not a separate measure type

VPN falls under access control and encryption of communication, not under a separate category. Article 21(2) of the NIS2 Directive contains no literal VPN requirement; the ten measures there are formulated functionally, including under (f) (access policy) and (h) (encryption). A customer who specifically asks about VPN typically translates that functional requirement into one concrete technique — often because his own questionnaire format dictates it, not because the law uses that word.

If employees work remotely via VPN, the substantiation is usually a section of the access policy stating VPN as a requirement for remote access, possibly supplemented with a configuration overview or a screenshot from the management console. If that document is missing, then "no" with a brief explanation (for example: remote access operates via another controlled method) is better than a VPN answer without source — the dossier only records what it can substantiate, and in case of doubt the field remains open for own completion. This aligns with access control and management of business assets,

Where this comes from: Annex A and Article 21 paragraph 2

ISO/IEC 27001 Annex A mentions network security and cryptographic measures as control measures, but VPN is not named there either — it is an implementation choice under a broader control. Organizations already ISO 27001-certified can typically refer to the Statement of Applicability for this question instead of searching for separate VPN evidence; see what an ISO 27001 certificate does and does not cover. For organizations that will fall under the Cybersecurity Act once it enters into force on 15 August 2026, the same functional formulation from the NIS2 transposition applies — the law prescribes the objective, not the means.