we don't have an ISO certificate, how do I answer that question well

No certificate is not a "no", but a different substantiation

Do not automatically enter "no" for this question. An ISO 27001 certificate is proof from an auditor that the management system complies with the standard — but your customer's underlying question is usually about the measures themselves, not about the piece of paper. If you have policies for access control, incident handling, continuity and the other components from Annex A of ISO 27001, you can describe that without claiming certification. Answer the question in two layers: first the fact ("not certified"), then the explanation ("but policies that align with the following components"). This way the answer remains accurate, and it still gives your customer something usable.

In practice, the questionnaire usually splits this itself already: one question about the company's ISO 27001 certificate separately, and individual questions about the underlying measures. Answer those on their own merits — for example the question about access policies and management of business assets or that about risk analysis and security of information systems. If you don't have a document for a specific component, answer "no" or "partially" to that — not to the whole list at once because the certificate is missing. One missing piece doesn't need to taint every other answer.

Annex A and Article 21(2) call for measures, not a certificate

ISO/IEC 27001 itself consists of two parts: the requirements for the management system, and Annex A with the control measures (access, cryptography, suppliers, incidents, continuity, and so on). A certificate shows that an auditor has assessed the system; it is not the only way to demonstrate that the measures are in place. Article 21(2) of the NIS2 Directive as well, with its ten mandatory measures, asks about what an organisation does — not about which certificate it holds. For most questionnaires, therefore: policies and demonstrable practice answer the core of the question, even without an ISO certificate.