customer asks whether we revoke access of former employees immediately, how do I prove that

Revocation upon termination is usually the answer; "immediate" is the pitfall

Yes, in most cases you can answer affirmatively here — but only if you can demonstrate that the process actually takes place within a fixed, short timeframe, not merely that the policy prescribes it. The question tests two things at once: whether the rule is documented, and whether the process actually works in practice. Many entrepreneurs answer "yes" because the policy document states it, while the missing evidence is: a log or ticket overview showing when an account was actually disabled, compared against the last working day from HR records.

If you don't have that overview, don't automatically answer "yes". Without supporting evidence, "no" or "partial" is the more honest answer, even if you're certain the process exists — the customer is asking for demonstrability, not a promise. This subject is related to access control and asset management: whoever does not centrally register access to systems and equipment cannot demonstrate upon termination that everything has been revoked. And because access revocation often coincides with an incident-like action (an account that must be "switched off"), it's smart to align this answer with the procedure for security incidents: some customers expect a forgotten account to be logged as an incident.

The basis is set out in Article 21(2), point (i)

This question falls under the ten measures of Article 21(2) of the NIS2 Directive, specifically point (i) on personnel security and access control. ISO/IEC 27001 elaborates on this further in Annex A, in the control measures on termination or change of employment and on access rights. Companies that are already ISO 27001-certified usually have this evidence as part of their audit file — no certificate, then your own log or ticket overview is the most direct alternative.