they want to know what our password policy looks like

Password policy is part of access control, not MFA

Questionnaires usually list "password policy" as a separate item, but the answer substantively belongs with access policy, including management of business assets. Describe at minimum: minimum length, complexity requirements, mandatory change upon suspicion of misuse (not standard periodic change — this is now considered outdated), and what happens after a number of failed login attempts. Also state whether passwords are centrally managed via a password manager or identity provider, or whether users manage this themselves.

A common mistake: describing password policy separately from multifactor authentication for access to business systems, while the customer often wants to know whether a weak password is compensated by a second factor. Place these two answers side by side in the supply chain file, even if it costs the questioner two separate questions — it saves an explanation you would otherwise have to type repeatedly. If you have no documented password policy but do require a password manager for everyone, describe that factually; "no" with a brief explanation is a more complete answer than a "yes" that overstates the practice.

Where this comes from: Article 21(2) and Annex A

Password policy is not a separate item in Article 21(2) of the NIS2 Directive; it falls under the broader access control measure within those ten measures. In ISO/IEC 27001 Annex A it is more explicit as a control measure within the access security topic. Questioners asking about "password policy" usually draw that term from Annex A, even if they refer to NIS2 obligations — which is why the answer in practice ends up in the same place in the file.