we are not ISO 27001 certified, what do I write in the questionnaire

Answer substantively without a certificate

Without ISO 27001 you do not enter "no" and leave it at that — you answer the underlying question substantively, per measure. A questionnaire that asks about the certificate actually wants to know whether the ten measures from Article 21(2) of the NIS2 Directive (risk analysis, incident handling, business continuity, supply chain security, vulnerability management, cryptography policy, access control, MFA, and the rest) are in order. The certificate is one way to demonstrate that, not the only way. Without a certificate you therefore answer per measure what you do have: a policy document, a procedure, a tool, a contractual agreement with a supplier.

In practice, this means that you answer the question about the certificate itself briefly and factually — is the undertaking ISO 27001-certified? describes how you substantiate that specific question without a certificate — and that you subsequently do not skip the follow-up questions. Many portals split the certificate and the underlying measures into separate questions; if you only enter "no" for the certificate and leave the rest blank, the recipient misses precisely the information with which he makes his own risk assessment. Rather fill in each component with what is factually present, even if that is not an externally audited whole.

Where that relationship follows from: Annex A and Article 21(2)

ISO/IEC 27001 Annex A describes the control measures that a management system must cover, and those measures largely overlap with the ten categories from Article 21(2) of the NIS2 Directive. A recipient who asks about the certificate is in fact testing whether those underlying measures exist; the certificate is the confirmation by an external party, but the questionnaire itself often also asks separately about components such as access control and asset management or the procedure for security incidents. Without a certificate that underlying question remains, and it remains worth answering.