customer asks who our CISO is but we don't have a separate role for that

No CISO on staff is not a problem

The question about a CISO is not about a title on a business card, but about the role: who is responsible for information security and cybersecurity, and who can the customer contact if something happens. In smaller organisations, that role often falls to the director, the IT manager or someone who does it "on the side". That is a valid answer, as long as you can identify who it is and what that person does.

Answer the question with the function that does fulfil the role, not with "n/a". Typical response: "the CISO role is fulfilled by [function], responsible for [tasks]". This aligns with what customers test in practice: not the title, but whether there is oversight of risk analysis and the protection of information systems and whether security measures are tested periodically. Governance is the underlying theme, not a personnel question.

Governance is separate from the job title

Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555) lists ten categories of measures, including policies on risk analysis and security of information systems — a CISO title does not appear in that list. ISO/IEC 27001 works with the same logic: Annex A requires assigned responsibilities for information security (often under A.5, organisation of information security), not a specific job title. The customer's questionnaire usually translates that requirement to "who is the CISO" because that is the common term in larger organisations, but the underlying question remains: is the responsibility assigned. Once that is established — even in a job description of the director — there is a factual basis for an answer, even without the title itself.