Does the enterprise have a policy for risk analysis and the protection of information systems?

Risk analysis policy is the foundation for the other nine measures

Yes, in most cases there is something to say here, because risk analysis is mentioned as the first measure in Article 21(2) NIS2 and is thus the foundation on which the rest of the policy rests. The question tests not only whether a document "risk policy" exists, but whether the enterprise systematically identifies which information systems and processes are vulnerable, and what measures are in place to address them. A customer asking this question actually wants to know whether security is based on risk assessment or is ad hoc.

In practice, this field is often difficult to answer with a simple yes, because risk analysis is usually not a separate policy document but is intertwined with other components: is the access policy documented, including the management of business assets, is there a process for identifying and remediating vulnerabilities, and is the effectiveness of security measures periodically reviewed. Without an underlying document describing the risk assessment — even if it is a simple internal overview — a "yes" here cannot be substantiated. If that document is missing, then "no" or "partially" is the honest answer, possibly with an explanation of which components are already in place.

Where this precisely follows from Article 21(2)

Article 21(2)(a) of Directive (EU) 2022/2555 lists "policy on risk analysis and security of information systems" as the first of the ten mandatory measures, and is thus the most direct source for this question. The directive itself does not detail how a risk analysis should be set up — that detail is left to national implementation rules or standards such as ISO 27001, which is incidentally different from this policy question: see is the enterprise ISO 27001-certified. To check whether the enterprise itself is already covered by the directive, see is the enterprise covered by the NIS2 directive or its national implementation.