customer asks about security of our cloud provider what should I answer

Cloud provider falls under Article 21(2)(d)

Answer with what you can actually substantiate: the contractual agreements with your cloud provider on security, and possibly a certificate or audit report that the provider has given you. The question about your cloud provider's security falls under the category of supplier security: Article 21(2)(d) NIS2 explicitly mentions the security of the supply chain, including the relationship with cloud service suppliers. Your file does not need to prove the cloud provider's own security — the provider does that itself, via their own certificate or transparency report. What you must be able to demonstrate is that you examined that security before taking on the service and that you repeat this periodically.

If you do not have that evidence — no copy of an ISO 27001 certificate from the supplier, no SOC 2 report, no clause in the contract on incident notification — then "no" or "not demonstrated" is the correct answer, even if you do trust the supplier. Trust is not evidence. In practice: request this evidence from the supplier anyway (the larger cloud providers usually have this available as standard in a trust center or similar portal) and add it to your supply chain file as soon as you have it. The same question is often related to security requirements you set for suppliers yourself — if you have already established policy for this, the cloud provider is a concrete example of it.

Where this is in the ten measures

Article 21(2) NIS2 lists ten measures an entity must take; subsection (d) specifically concerns the security of the supply chain, with an explicit reference to the security aspects of relationships with suppliers. ISO/IEC 27001 elaborates on this in Annex A under the control measures for supplier relationships, which also includes requirements for cloud and ICT service providers. If your own company is itself an entity under the Cybersecurity Act, then this is not a separate question but part of an obligation — check this if necessary with the question whether your company falls under NIS2.