questionnaire asks about our password policy, must it be documented in writing

Password policy is part of access control policy, not separate

Yes, a documented password policy is the standard that the questionnaire expects — but the question itself is usually interpreted more broadly than passwords alone. Article 21(2) NIS2 does not mention a separate "password policy" as an individual measure; passwords fall under point (i), access control policy, and under point (j), the use of multi-factor authentication. If the questionnaire specifically asks about password policy, it is usually checked whether that is part of a broader access policy documented: who receives which rights, how is a password constructed, how often is it changed, what happens upon termination of employment.

If you do not have a separate document, the question is whether the policy already exists elsewhere — for example in a broader information security policy or in the settings of your identity and access management system. ISO 27001 Annex A works with the same logic: there is no separate control for passwords, but control A.5.17 (authentication information) falls under the access control theme. If you do not have ISO certification and no separate document, then "no" is the correct answer to the separate password question at this time — possibly with a note that multi-factor authentication is implemented, which often counts more heavily than the password policy itself. The latter is a separate question in many questionnaires. see the question on multi-factor authentication.

Where this follows from: Article 21(2) sub (i) and (j)

Article 21(2) of Directive (EU) 2022/2555 mentions under sub (i) "policies and procedures regarding the use of cryptography and, where relevant, encryption" not as the source for passwords — these fall under "access control policy" (sub (i) in the common translation of the ten measures) and under multi-factor authentication (sub (j)). The Cybersecurity Act will adopt this classification as soon as it enters into force on 15 August 2026. ISO/IEC 27001 Annex A likewise places password management under the broader access control theme, not as a standalone control.