customer asks for results of our latest pentest, do we need to provide them

Do not share the report itself, but confirm the outcome

No, you typically do not provide the penetration test report one-to-one to the customer. What your customer is asking for is evidence that you identify and remediate vulnerabilities, not the technical details of how someone could once gain access. A report with exact findings, IP ranges and exploit paths is a risk for the customer itself: the more parties that have that document, the greater the chance that it ends up in the wrong hands. The standard approach is a summary answer: when the last test was performed, by whom (internal or external), whether there were critical findings, and whether those have been resolved. This aligns with the process for identifying and remediating vulnerabilities — this is often asked for as a separate section, and the penetration test question is in fact a specific form of it.

If the customer wants more detail, this can be provided via a management summary without technical exploit details, or via a statement from the testing party. If no recent penetration test has been performed, the most honest answer is to say so — do not invent a test that does not exist. If you are unsure whether something is sensitive enough to withhold, use the confidentiality button in the file instead of deciding for yourself what is and is not shared.

Where this comes from: Article 21(2) and Annex A

Article 21(2) of the NIS2 Directive explicitly lists among the ten measures policy and procedures to assess the effectiveness of cybersecurity measures — a penetration test is a common implementation of this, not the only one. ISO/IEC 27001 elaborates on this in Annex A through control measures relating to technical vulnerability management. Neither source requires sharing a complete test report with a customer or supply chain partner; they require the organisation to demonstrate that it tests and follows up. For those who need to determine whether this chapter is applicable at all, there is the question of whether the organisation itself falls under the NIS2 Directive or the national transposition thereof.