questionnaire asks if we have conducted a penetration test

Pentest is evidence, not a standalone requirement

A pentest — a penetration test, in which someone actively attempts to break into a system — is not listed as a separate mandatory element in any of the ten measures of Article 21(2). The question usually comes from the measure on risk management and vulnerabilities: the customer wants to know whether you test whether your security holds up in practice, not just on paper. The same applies to ISO/IEC 27001: Annex A does not mention a mandatory pentest, but it does mention technical vulnerability management, and a pentest is the most concrete implementation of that which auditors recognize.

If you have never had a pentest carried out, then "no" is the correct answer — suggesting a "yes" without a report cannot be justified. Many companies fill this in with what they do have: a vulnerability scan, an external audit, or an ongoing process for identifying and remedying vulnerabilities. That is not the same as a pentest, but it shows that something is in place. Whether you explain that difference to the customer is up to you; the answer field itself remains factual. If you have had a pentest done, then the report — or a summary of it — is the supporting document that goes with a "yes", possibly with the confidentiality button if you do not want to share the details.

Where this comes from: Article 21 and Annex A

Article 21(2) of Directive (EU) 2022/2555 mentions vulnerability management and the assessment of the effectiveness of measures as mandatory elements, without prescribing a pentest as a method. The Cyber Security Act incorporates this obligation once it enters into force. ISO/IEC 27001 Annex A elaborates on this further under the control measures for technical vulnerability management, where a pentest falls under common practice. Anyone who can demonstrate that the effectiveness of security measures periodically reviewed is often already part of the answer, even without the word pentest appearing in their own file.