customer asks if we have had a penetration test carried out what do I say

Pentest falls under testing, not under a separate box

A pentest (penetration test) is one way to demonstrate that security works — not a standalone requirement. The question belongs to the broader point about periodic testing of the effectiveness of measures. If you have had a pentest carried out by an external party in the past year, you answer yes and provide the report or the management summary as evidence. Some customers want to see only the date and scope of the test, not the vulnerabilities found themselves — for that you can use the confidentiality button in the portal if that option is available.

If you have not had a pentest done, then "no" is the correct answer — not "yes" with a reference to something else. A vulnerability scan, an internal code review or ISO 27001 certification are not a substitute for a pentest, even if they address the same subject. If you do systematically identify and remediate vulnerabilities via another route, you can explain that in the free text field, but that is an addition, not a substitute "yes" to the pentest question itself. If you are uncertain whether your test report is old enough to still count, the safest choice is to mention that in the explanation rather than omitting it.

Where this comes from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555) explicitly lists testing and assessing the effectiveness of cybersecurity measures among the ten measures; a pentest is the most concrete implementation form thereof. ISO/IEC 27001 Annex A links this to the control measure on technical vulnerability management and independent assessment of information security. The Cybersecurity Act, the Dutch transposition of NIS2 which enters into force on 15 August 2026, sets out this obligation for entities falling under the act — ask your customer whether the entity they represent thus possibly falls under such an obligated party, and test therefore whether the undertaking itself falls under NIS2 or the national transposition to understand why this question appears on the list at all.