questionnaire asks if we conduct phishing tests among staff

Phishing tests are evidence of awareness, not of access

Phishing simulations are part of the awareness programme under Article 21(2)(g) NIS2, not access control or MFA. The question therefore does not test whether your technical controls are in order, but whether employees are trained to recognise social engineering. If you have a periodic phishing test with reporting and follow-up (for example additional training for those who click), this is a clear "yes" with strong evidence attached. If you only have e-learning without simulation, the answer to this specific question is often still "no" — the questionnaire usually explicitly asks for a test, not for training in a general sense.

Without a phishing test, "no, but" is the honest answer here: then name what you do have, such as mandatory awareness training or a reporting button for suspicious emails. That is not a weak bid — many companies start with training and expand simulations later. If you are unsure whether your campaign is representative enough (for example one test per year versus monthly), then it is better to put "to be determined" and ask internally from whoever manages the campaigns, usually IT or HR. Also check whether this topic stands separately from the training that employees receive in cyberhygiene in a broader sense — some customers ask that in two separate questions, others combine it.

Where this comes from: Article 21(2)(g)

Article 21(2)(g) of NIS2 explicitly mentions "basic practices in the field of cyberhygiene and training in the field of cybersecurity" as one of the ten mandatory measures. Phishing simulations fall in practice under this training obligation; ISO/IEC 27001 Annex A mentions awareness and training measures in the same spirit, without naming a phishing test as a separate requirement. If you yourself fall under the Cybersecurity Act as an entity covered by the NIS2 Directive, then this is one of the measures on which supervision is possible from the time of entry into force — for now it remains primarily a question that customers themselves are already asking, in anticipation of that legislation.