customer wants to know how our cloud provider is secured, what do I enter there

This question falls under supply chain oversight, not under your own security

This falls under Article 21(2)(d) NIS2: security in the supply chain, including the relationship with your own suppliers. The customer is not asking here whether your systems are secure, but whether you know and can demonstrate that your cloud provider is. That is a different piece of evidence than, for example, your own access policy or your own encryption policy.

The answer usually consists of two layers. First: have you set your own security requirements to that supplier, contractually or in the selection? You answer this based on your own procurement file, not based on what the supplier claims. Then: what does the supplier itself demonstrate? Request the piece of evidence that it normally already shares with customers — an ISO 27001 certificate with scope statement, a SOC 2 report, or a summary of its NIS2 measures if it is itself subject to the directive. If you do not have that certificate in your file, then "no" or "unknown" is the correct answer — not "yes" based on an assumption. This aligns with security requirements that the undertaking sets to its own suppliers: this evidence should normally be in place here as well, even if it is one major cloud party instead of a long chain of sub-suppliers.

Where the evidence comes from: Annex A versus the contract

ISO/IEC 27001 Annex A does not have a separate "cloud security" section; the evidence is distributed across the control measures for supplier relationships and access. In practice, this means: first check whether you yourself already has documented what access policy and management of business resources applies, because this often also states how access to the cloud environment is arranged. For the supplier itself, the certificate or audit report is the source, not a statement from you about their systems — you cannot confirm on behalf of the supplier what they do internally.