questionnaire asks about the security of our cloud provider

The cloud provider falls under supply chain security, not under your own measures

This question is not about your own systems, but about a supplier in your chain. Article 21 paragraph 2 of NIS2 explicitly mentions under point (d) "the security of the supply chain, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers." Your cloud provider is such a direct service provider. The customer therefore does not want to know whether the cloud itself is secure — no one can guarantee that — but whether you as a customer have assessed whether that supplier has a sufficient level of security, and whether that is documented somewhere.

The proof document usually requested here is not your own ISO certificate, but that of the cloud provider itself: an ISO/IEC 27001 statement, a SOC 2 report, or a reference to the contractual agreements on data protection. If you do not have that at hand, then "no, not yet documented" is a more honest answer than a sloppy commitment — especially because security requirements for own suppliers often comes up again more broadly in the same questionnaire, and inconsistency between two answers is noticeable. Also check whether the question is actually about encryption of data in the cloud — that is often presented in the same breath as "cloud security", but is a different underlying measure.

Legal basis: Article 21 paragraph 2 under d, supplemented by Annex A of ISO 27001

The obligation to assess suppliers and service providers is set out in Article 21 paragraph 2 under d of NIS2 and will reappear in the Dutch Cybersecurity Act once it enters into force on 15 August 2026. ISO/IEC 27001 Annex A elaborates on this further in the control measures for supplier relationships (categories A.5.19 to A.5.23), which specifically address the assessment and monitoring of cloud and IT service providers.