customer asks whether we have recently had a penetration test carried out

Pentest is evidence of testing, not a separate criterion

A penetration test is one of the ways to demonstrate that security is tested periodically, not a standalone requirement in itself. Article 21(2) NIS2 mentions under point f "policies and procedures to assess the effectiveness of measures", and a pentest is one way to fulfil this alongside, for example, a vulnerability scan or an internal audit. If the question explicitly asks for a pentest, you may answer "yes" as soon as you have a test report, regardless of how the rest of your testing process looks.

If you have not conducted a pentest but have other forms of testing — an external security audit, ISO 27001 certification with associated internal audits, or an automated scan — then "no" to the literal question is the correct answer, with possibly an explanation of the alternative testing in the free text field if such a field is available. Do not enter "yes" because you "do something about testing"; the question is specific enough to be treated as a separate fact. This topic also touches on the question of whether the effectiveness of measures is tested periodically, and often also the process for identifying and remediating vulnerabilities, because pentests and vulnerability scans are in practice often asked interchangeably while they are two different measures.

Where this appears: Article 21(2) sub f, Annex A

Article 21(2) sub f of Directive (EU) 2022/2555 requires "policies and procedures to assess the effectiveness of cybersecurity risk management measures", without specifically prescribing a pentest. ISO/IEC 27001 Annex A elaborates this further in the control measures around technical vulnerabilities and assessment of information security, where a pentest fits as a practical implementation but is not mentioned as a mandatory instrument. The Cybersecurity Act will adopt this requirement once it enters into force, without, as expected, linking a specific test type to it.