questionnaire asks about firewall and network segmentation how should I answer

Firewall and segmentation fall under access policy

The question on firewall and network segmentation is an elaboration of Article 21(2)(i) NIS2: access control and management of business resources. Segmentation is not an isolated measure but evidence that network zones are separated — production environment separate from office automation, guest network separate from internal traffic. If you already have an answer ready from access control policy,you can largely reuse that answer: the questionnaire asks for the same control in different words.

Concrete evidence is usually a network diagram showing the zones, a firewall ruleset (or a summary of it, without sensitive details) and a date of the last review. If that is missing, then "no, not yet formalized" is a valid answer — better than a "yes" without supporting documentation. Segmentation often goes hand in hand with vulnerability management: a network that is well segmented also limits how far an unpatched vulnerability can spread. If you have already described that process in the answer on vulnerabilities,you can refer to it as supplementary, not as a replacement.

Where that appears in the directive and the standard

Article 21(2)(i) NIS2 lists access control policy and management of business resources as one of the ten mandatory measures; network segmentation is not explicitly mentioned in it, but is the standard technical implementation thereof. ISO/IEC 27001 Annex A elaborates this further under the control measures for network security, where segmentation is mentioned as an example measure. In the Netherlands, this runs parallel with the Cybersecurity Act, the transposition of NIS2 which enters into force on 15 August 2026 — until that date, the directive itself remains the text to fall back on in case of doubt about the precise wording.