customer wants to know if our cloud service is sufficiently secured what do I answer

Cloud provider falls under supply chain security policy, not under a separate field

This question is almost never a standalone yes/no. The customer is actually asking whether your supplier management also applies to your cloud provider, and that falls under security requirements for own suppliers — point (d) of the ten measures in Article 21(2) of the NIS2 Directive. The answer thus consists of two layers: does the entity have a supplier policy, and has the cloud provider been concretely assessed against it. A "yes" to only the first layer without the cloud provider ever being evaluated is a half-truth that will come back in an audit.

What counts as evidence varies depending on the maturity of the file. If the cloud provider itself has an ISO 27001 certificate or a SOC 2 report, that is the strongest piece — set it alongside the question of whether the entity itself is ISO 27001-certified, because those are two separate certificates that must not be confused with each other in the answer. If a certificate is missing, then a data processing agreement with a security annex, or an own supplier assessment with a date, is the second-best evidence. Without one of the two, "no" or "in progress" is the correct answer, even if the cloud provider is probably very well secured — probability is not proof.

Where this follows from: Article 21(2)(d) and Annex A.15

The obligation to assess suppliers and service providers for security is explicitly mentioned in Article 21(2)(d) of the NIS2 Directive, as one of the ten measures an entity must take. ISO/IEC 27001 elaborates on this further in Annex A under the control measures for supplier relationships. In the Netherlands, this will run through the Cybersecurity Act, the national transposition of NIS2 which enters into force on 15 August 2026 — until that date, the Directive itself remains the text to refer to. If you are unsure whether this is already an obligation for your own entity and not just a question from a customer, check whether the organisation itself falls under the NIS2 directive.