questionnaire wants to know how we regulate access to systems, what do I answer

Access management revolves around authorization, verification and logging

This question falls under access control policy, and most questionnaires split it into three parts: how is access granted and revoked (authorization), how is the user's identity verified (authentication), and is it recorded who accessed which system when (logging). A complete answer addresses all three. For authorization, the standard answer is that access is granted based on function or role, that rights are reviewed when there is a change of function or termination of employment, and that there is periodic review of outstanding accounts. If there is no established process but access is nonetheless granted manually and on a limited basis, a realistic answer is "partially" with a brief explanation, not "yes".

For authentication, it is often asked separately whether multi-factor authentication is used for access to company systems — that is a standalone answer, even if the access policy is otherwise in order. For logging, the supporting document is usually an export from the identity and access management system, or a screenshot of the role structure; a policy document without an underlying system rarely convinces. If that evidence is missing, then "no, not yet formalized" is a viable answer — the risk lies in "yes" without supporting documentation.

Traceable to article 21 paragraph 2 and Annex A

Access management is mentioned as a separate measure in article 21 paragraph 2 of the NIS2 Directive, alongside the broader requirement that the access policy including the management of business assets is documented. In ISO/IEC 27001 the same requirement appears in Annex A, under the control measures for access control; anyone already certified for that subject can provide that certificate as supporting evidence instead of gathering individual documents.