customer asks if we perform phishing tests with employees, what if we don't

Phishing tests are evidence, not a mandatory form

No, phishing tests are not as such mandatory. What does count is that employees receive regular training in cyberhygiene, and a phishing test is the most concrete piece of evidence that a customer can verify. Training without assessment is harder to verify; a simulation with a click rate and a report is directly demonstrable to the customer. This is why this specific item often appears separately in questionnaires, aside from the more general question of employees receive training in basic cyberhygiene practices.

If no phishing test is conducted, the most honest answer is "no", possibly supplemented with what is being done instead: e-learning, instruction during onboarding, an internal mailing about recent fraud cases. This is not an equivalent replacement, but it shows that something is being done to raise awareness. Simulating a phishing test as an answer when it is not being conducted is not appropriate — the dossier only records what is verifiable, and "yes" without a source is not offered here. Incidentally, phishing often comes up as the cause of a security incident, so anyone entering "no" here can expect a follow-up question from the customer about the procedure for handling security incidents.

Where this appears: Article 21(2), point (g)

Article 21(2) of the NIS2 Directive lists among the ten measures "basic practices for cyberhygiene and training on cybersecurity" (point g). The Directive does not prescribe an instrument — no phishing test, no specific teaching method — but leaves the implementation to the entity itself. ISO/IEC 27001 includes a comparable control measure in Annex A on awareness and training, also without mandatory form. The Dutch Cybersecurity Act is the transposition of this Directive and enters into force on 15 August 2026; until then this is not yet a statutory requirement for most businesses, but a customer can already ask about it via their own questionnaire, in anticipation of that date or because they themselves are already under supervision.