the questionnaire asks whether we have had a penetration test carried out

Pentest is evidence for testing, not a separate requirement

A penetration test is not listed as an independent obligation in Article 21(2) NIS2. The question falls under measure (f): the policies and procedures to assess the effectiveness of security measures. A pentest is one way to test this, alongside for example a vulnerability scan or an internal audit. If the customer specifically asks for a pentest, they usually want to know whether the technical measures have ever been independently verified to actually work, not just on paper.

If you have had a pentest carried out, the report (or a summary with date, scope and remediation of findings) is the evidence. If you have not, then "no" is the honest answer — that is not an automatic rejection, especially not for smaller suppliers without mandatory applicable entity status under the directive. More important than the word "pentest" is whether you test the effectiveness of security measures periodically in another way, and whether that is connected to an ongoing process for identifying and remedying vulnerabilities. Do not therefore enter "yes" in the absence of a report, even if you have run a scan — a scan and a pentest are in most questionnaires explicitly different things.

Where this comes from: Article 21(2) and ISO 27001

Article 21(2) of Directive (EU) 2022/2555 lists under point (f) the "policies and procedures to assess the effectiveness of measures for cybersecurity risk management" as one of the ten mandatory measures; a pentest falls under this as a testing method but is not named explicitly. ISO/IEC 27001 Annex A elaborates on this in control measures around technical vulnerabilities and independent assessment of information security, in which pentests are common practice but are likewise not made mandatory. The Cybersecurity Act, the Dutch transposition of NIS2, comes into force on 15 August 2026 and will contain the same ten measures; until that date the directive itself is the framework to be followed.