se întreabă pentru politica noastră completă de securitate sub formă de document

Sharing the complete policy document is usually not necessary

No, in most cases that is not necessary, and it is also not what the customer actually wants to know. A question like "send your security policy" is almost always a translation of something more specific: the customer wants to know whether there is a policy for risk analysis, whether there is an incident procedure, or whether access is properly regulated. These are the ten measures from Article 21(2) of NIS2, and you see the same subdivision reflected in the control measures of Annex A of ISO/IEC 27001. A questionnaire that asks for "complete policy" usually still splits that into sub-questions — so first check whether that is the case before you upload a complete document.

The risk of sending a complete policy document is not legal but practical: it often contains more than the customer needs — names of tools, internal procedures, contact details of staff. Those who prefer to answer per question instead of sharing a document can use the confidentiality button to limit it to what is actually being asked. If the question is specific to a sub-topic, the answer is often already to be found elsewhere: or the access policy is documented, or there is a procedure for incidents, or periodic testing is carried out. This is usually more concrete to answer than with a complete document.

De unde rezultă aceasta: articolul 21 alineat 2 și Anexa A

Article 21(2) of NIS2 lists ten concrete measures — risk analysis, incident handling, business continuity, vulnerability management, access policy and more — without requiring that a third party sees the underlying document itself. ISO/IEC 27001 Annex A works with the same logic: the control measures are auditable per component, not as one undivided policy document. Also keep in mind that the question of whether the own enterprise falls under NIS2 or the national implementation is separate from what a customer requests in a questionnaire — these two things are often confused.