we don't have an IT department, who should fill in this security questionnaire

No ICT department is not an exemption

The questionnaire is not about who is on the payroll, but about whether the ten measures of Article 21(2) NIS2 are in place — even with five staff members. A customer sending out this questionnaire wants to know whether risk analysis, incident handling, continuity and access control are arranged, not whether there is a department with that name for it. In a small business, the answer often lies with the owner or an external IT service provider, and that is a valid answer: who does it is not in the questionnaire, only whether it happens.

In practice, this means that whoever manages the hosting, the laptops or the accounting software — often an external firm — has the actual answers to questions about back-ups and contingency measures and about multi-factor authentication. That service provider does not need to fill in the questionnaire, but provides the evidence or confirmation with which the entrepreneur themselves answers. For questions that are about policy rather than technology — who may access what, what happens in an incident — the knowledge usually lies with the owner themselves, even without an ICT background.

Article 21(2) calls for measures, not a job title

Article 21(2) of the NIS2 Directive lists the ten measures as a results obligation for the entity, without imposing requirements on the organisational structure used to achieve that result. Annex A of ISO/IEC 27001 elaborates the same measures into control measures that can equally be performed by an external party as by internal staff. Whether the undertaking itself falls under the Directive is, incidentally, a separate question, independent of who fills in the questionnaire — that can be derived from the entity's own NIS2 status.