customer wants to know whether we carry out phishing simulations with employees

Phishing tests are part of awareness, not a separate measure point

Phishing simulations fall under article 21(2)(g) NIS2: cyber hygiene and security training. There is no requirement that it must specifically be a phishing test — the directive refers to "basic practices in cyber hygiene and training in cybersecurity". A phishing simulation is one of the common ways to implement this, not a standalone obligation. Anyone who does not run simulations but has other awareness activities — e-learning, toolbox sessions, an intranet message about a current threat — meets the underlying standard, even if the answer to the literal question is "no".

The label depends on what you actually do. If you run phishing tests periodically with reporting to management, then "yes" is substantiated and you can provide the frequency and most recent results (click rate, reporting rate) if requested. If you do not do this, then "no" is the correct answer — do not enter what your customer wants to hear. If you are unsure whether your training programme without simulations still counts as adequate awareness, it helps to first look at the broader question whether employees receive training in basic cyber hygiene practices; phishing tests are part of that, not the whole.

Where this stands: article 21(2)(g) and Annex A.6.3

NIS2 article 21(2)(g) names cyber hygiene and training as one of ten mandatory measures for entities covered by the directive — whether that applies to you is described in whether the enterprise itself falls under NIS2. ISO/IEC 27001 Annex A elaborates this in measure A.6.3, "information security awareness, education and training", without naming phishing simulations as a mandatory tool. The Dutch Cybersecurity Act will transpose this article when that law enters into force on 15 August 2026; until then, the directive itself is the source for those assessing against NIS2, and the standard for those assessing against ISO 27001.