questionnaire asks if we conduct phishing tests with our staff

Phishing tests are part of cyber hygiene, not awareness alone

A phishing test is not a standalone requirement, but evidence for one of the ten measures under Article 21(2) NIS2: paragraph (g), cyber hygiene and security training. The directive itself does not prescribe phishing simulation — it refers to "basic practices in cyber hygiene and cybersecurity training". A customer who specifically asks for phishing tests translates that standard into a concrete, testable practice. Under ISO 27001, this falls under Annex A in the control measure for personnel awareness, training and education: the standard requires a programme, and a phishing test is its most commonly used supporting document.

If you have no structured phishing tests, then "no" is the honest answer — awareness training without simulation is something different and the assessor on the other side usually knows this too. Many customers ask follow-up questions about frequency (annually, quarterly), what happens to employees who fall for it, and whether there is e-learning attached. If there is but it is not labelled as "phishing test", describe what you do instead in the explanatory field rather than simply ticking "yes". This topic also touches on training in basic practices for cyberhygiene, where the broader training obligation is set out — phishing tests are usually one item from a larger policy document.

Where that appears in the directive and the standard

Article 21(2)(g) of Directive (EU) 2022/2555 lists cyber hygiene and security training as one of the ten mandatory measures; the Cybersecurity Act will implement this one-to-one once it enters into force on 15 August 2026. ISO/IEC 27001 Annex A elaborates on this further under the control measure for personnel awareness and training, within which phishing simulations are the standard form of testing. Whether the organisation itself must comply strictly here depends on the answer to whether the organisation itself falls under the NIS2 directive — an indirect supplier often receives the question through contractual pass-through rather than direct legal obligation.