customer asks whether our data is encrypted during storage and transmission

Encryption at rest and in transit are two separate points to confirm

The question often contains two sub-questions in one: encryption "at rest" (storage) and "in transit" (transmission). Answer them separately, because it happens that one is regulated and the other is not — for example TLS on all connections, but no encryption of the underlying database. State in your answer specifically which of the two you have addressed, instead of one summarizing "yes".

What you need to confirm: the protocol used for data traffic (usually TLS 1.2 or higher) and the method for storage (usually AES-256 or equivalent). If this is not laid down in a cryptography policy, there is nothing to confirm — then "to be determined" is the correct label, not an educated guess. This aligns with the question whether there is a policy on the use of cryptography and encryption: without that policy the source on which this answer can rely is missing. Encryption is also connected to who has access to the keys; if nothing about this is documented, that is an indication that access control policy is also incomplete.

Why this recurs separately in Article 21(2) and Annex A

Encryption of data is mentioned as a separate measure in Article 21(2) of the NIS2 Directive, among the ten measures listed there — this is therefore not a general "best practice" but a specific test point. In ISO/IEC 27001 cryptography recurs as its own category in Annex A, separate from access control and separate from continuity. That separation in the sources is precisely why customer questionnaires often present storage and transmission as two sub-questions: they follow the structure of the underlying standard.