how do I describe our password policy in the customer's security questionnaire

Password policy is part of access control, not cryptography

The question about password policy usually does not appear as a separate question, but as part of a broader section on access control. Therefore, do not only describe the password rules themselves — minimum length, complexity, expiration period — but place them in the context of who has access to which system and how that is managed. A customer asking about password policy is essentially asking about identity and access management. If access policy is established including the management of business assets, password policy is one rule from it, not a standalone document.

For a supplier that itself falls under a security standard, the customer expects more than just "passwords must be at least 8 characters". Describe whether password policy is technically enforced (via the domain or the identity provider) or only on paper, and whether a password manager is mandatory or recommended. Also mention whether shared accounts exist and how they are handled — that is often the follow-up question. If formal password policy is lacking, it is more honest to report that than to tick yes, which the file cannot support; many customers accept a compensating control, such as mandatory multi-factor authentication for access to business systems, as an alternative to strict password policy.

Where this is in the ten measures

Password policy falls under the access control measures in Article 21(2) of the NIS2 Directive, where it is mentioned together with personnel security and the management of business assets as one of the ten measures to be taken. In ISO/IEC 27001 this is elaborated in the control measures of Annex A, under the access security category — there password policy is explicitly linked to the broader authentication policy, not to separate technical settings. For suppliers that will fall under the Cybersecurity Act once it enters into force, the same classification is expected to apply, since that act follows the classification of the directive.