the questionnaire asks where and how we store the customer's data

Storage location and method: part of Article 21, not only of the GDPR

The question of where and how you store your customer's data often comes in as a privacy question, but in a NIS2 questionnaire it belongs to the ten measures of Article 21(2) of Directive (EU) 2022/2555. In particular, point (h) (security in the procurement, development and maintenance of systems) and point (i) (personnel policy and access policy) directly relate to storage: where the data is physically or virtually located, who can access it, and whether that storage is encrypted. A complete answer thus mentions three things: the location (own data centre, cloud provider, which region), the separation between customer environments if you work multi-tenant, and the encryption of data at rest and in transit.

If you do not have that last point ready, the answer is not to fill in "yes" but first to check what the policy on cryptography and encryption is actually documented within the organisation. Many companies encrypt data in transit (TLS) but not always at rest, and customers often ask about that difference separately. If you work with an external cloud provider, that also falls under the question of whether security requirements are set for own suppliers — the storage location is then in fact a chain agreement with that provider, and your answer can refer to the contract or the SLA with that party instead of to own infrastructure.

Where this is tested in ISO 27001

Whoever is ISO/IEC 27001 certified has already documented storage location and encryption in the Annex A measures on cryptography and asset management; the answer to this question can then simply refer to the certificate and the associated Statement of Applicability. Without that ISO 27001 certificate the answer must come from your own documentation: an architecture overview, a processing agreement with the cloud provider, or an internal note on data residency.