customer asks whether we carry out phishing tests on employees

Phishing tests are evidence, not a separate requirement

Phishing tests are not listed separately in Article 21(2) NIS2 — they are the evidence with which you demonstrate that the training obligation under point g (cyberhygiene and security training) actually works. If your customer specifically asks about phishing tests, they do not want to know whether you have provided training, but whether you measure whether that training is effective. If you have these tests, the answer is simple: yes, with the date of the last test and the percentage of employees who clicked through or reported it. If you do not have them, then "no" is the correct answer — not "yes" because there is an e-learning course.

If you do not conduct phishing tests but do something else — training during onboarding, an annual toolbox, an internal newsletter about suspicious emails — then that is a separate answer, not a replacement for the question as asked. Many questionnaires provide space for additional information; use that to describe what you do have, without suggesting that it is a phishing test. This falls in the same category as training in basic practices for cyberhygiene: if "no" is already the answer there, "no" is the obvious answer to this question, and there is little chance that you have evidence here all of a sudden.

Basis: Article 21(2), point g and its assessment

Article 21(2)(g) of Directive (EU) 2022/2555 explicitly mentions "basic practices in cyberhygiene and training in cybersecurity" as one of the ten mandatory measures; ISO/IEC 27001 Annex A elaborates on this under the control measures for personnel awareness and training. In practice, phishing tests are the measurement tool with which companies demonstrate that training is not only provided, but also effective — comparable to what is requested in the periodic testing of security measures. The Dutch Cybersecurity Act transposes this obligation directly, with entry into force on 15 August 2026.