questionnaire wants to know which cloud services we use for our data

Cloud providers are part of the supply chain question

The question about cloud services used falls in most questionnaires under the broader theme of supplier management, not under a separate "cloud" section. The customer wants to know whether your organisation has visibility over where business data is stored and who has access to it. Concrete answer: name the providers that process personal data or business-critical data (think of the major hyperscalers, but also a bookkeeping package or CRM in the cloud counts), and indicate whether there are contractual agreements on security in place.

A complete answer consists of two parts: the name of the provider, and proof that you manage that relationship. The second part is where most entrepreneurs get stuck — not because they don't use cloud services, but because they have no overview of which agreements have been documented. If that overview is missing, "to be determined" is a more honest answer than listing suppliers without substantiation. This topic directly relates to the question of the undertaking sets security requirements for its own suppliers: a cloud provider is in that sense simply a supplier, and the requirements that apply there — contracts, service-level agreements, incident agreements — are precisely what is being asked for here.

Where this appears in the directive: Article 21(2)

Article 21(2) of the NIS2 Directive mentions supply chain security, including the relationship between each entity and its direct suppliers, as one of the ten mandatory measures. Cloud providers fall under that chain. ISO/IEC 27001 develops this further in Annex A, where supplier relationships and the management of assets — including data held by third parties — are explicitly named; those who already have a process for access control and management of assets, have usually already documented which cloud services fall within it. The Cyber Security Act incorporates this requirement once that law comes into force.