customer asks about our password policy what should I answer

Password policy is part of access control, not cryptography

Password policy falls under access control, not under cryptography or authentication separately. If the list asks about "password policy" or "wachtwoordbeleid", it usually checks whether minimum requirements are established: minimum length, complexity, mandatory change upon suspicion of compromise, and a ban on reusing old passwords. Sufficient is a policy document containing those points, plus a technical setting that enforces them — not just a guideline that employees are expected to follow. If the document is missing but the setting is correct in Active Directory or the identity provider, that is often enough as evidence; a screenshot of the policy in system administration will then suffice.

If you have no separate password policy but do require multi-factor authentication for all business systems, that answer is often stronger than a password policy alone — many lists ask for that as a separate point, see or whether multi-factor authentication is mandatory for access to business systems. Enter that as a supplement, not as a replacement: a customer who specifically asks about password policy wants to see that point answered separately. If you have nothing documented, then "no" with an explanation that MFA is mandatory is often more honest and complete than a vague "yes" to a question you cannot support with a document.

Where that is in the standard and the guideline

ISO/IEC 27001 Annex A contains a specific control measure for authentication information, including password management; those certified for this can refer to it as evidence, see or whether the undertaking is ISO 27001-certified. NIS2 itself does not name password policy as a separate point among the ten measures of Article 21(2) — it falls there under the broader category of access control and system security. Questionnaires that refer to NIS2 often translate that broader point themselves into a concrete password question; the underlying requirement is then the access policy as a whole, not passwords specifically.