we don't have a CISO, who do I enter as responsible for security

No job title required, but an identifiable role

Article 21(2) NIS2 does not require a CISO. There is no requirement for a job title anywhere — the directive asks for "appropriate and proportionate technical, operational and organisational measures", and governance above that. What you must be able to provide is who internally decides on information security and who reports this to management. In a smaller company, this is often the director themselves, an IT manager with security as a partial duty, or an external party engaged on a structural basis. Fill in that role by name or function, not with "nobody" and not with a title that does not exist.

What you should pay attention to: the customer is not interested in the title, but in demonstrability. Can you show that someone is responsible for policy for risk analysis and the security of information systemsand that the same or another designated person is also the point of contact at security incidents? This is the evidence usually requested: an organisational chart, a RACI table, or simply a paragraph in the policy document that names the role and its powers. If you have not documented this, then "no" with an explanation that management holds this responsibility is a more honest answer than a made-up job title.

Where this comes from: Article 21(2)(a) NIS2 and Annex A 5.2 ISO 27001

Article 21(2)(a) lists "policy on risk analysis and information systems security" as the first of ten measures, and governance is an implicit part of it: without a designated responsible person, policy is not enforceable and not verifiable. ISO/IEC 27001 makes this explicit in Annex A 5.2, "information security roles and responsibilities", where a role is indeed requested but no specific title. If you fill in this list without ISO certification, it is all the more important that the role allocation is documented somewhere — that helps with the question of whether the organisation is ISO 27001-certifiedwhere you would otherwise have nothing to show.