customer asks if we have had a pentest performed, what should I answer

Pentest report is evidence, not a standalone requirement

A pentest — a penetration test, in which someone actively attempts to break into your systems — is not listed as a separate mandatory document anywhere in Article 21(2) of NIS2. Your customer's question falls under the measure concerning testing and evaluating the effectiveness of cybersecurity measures, and a pentest report is the most concrete piece of evidence available for this. If you have one, the answer is usually yes. If you have never had a pentest carried out, the answer is no — and that is not a problem in itself, as long as you can demonstrate elsewhere that you test the effectiveness of security measures periodically, for example with internal audits or vulnerability scans.

Pay attention when filling in to what is being asked exactly: a pentest report itself, or only confirmation that testing takes place. Some portals request the report as an attachment — that is a different request than a yes/no question, and reports often contain sensitive technical details. For that purpose, the confidentiality button exists: you decide yourself whether and with whom you share the full document, separately from whether the answer is yes or no. If you have had a pentest but the link with follow-up on identified vulnerabilities is missing, also check whether your process for identifying and remediating vulnerabilities is already included in it — many customers ask for that in the same section.

Where this follows from ISO 27001 and NIS2

Annex A of ISO/IEC 27001 has no separate control point for 'pentest', but the control measures on technical vulnerability management and on independent assessment of information security are in practice often substantiated with pentest results. NIS2, Article 21(2), lists among the ten measures both testing and evaluating policies and managing vulnerabilities and their disclosure as separate elements — a pentest report typically serves as evidence for the first, and its follow-up for the second.