Home
Penetration testing
NIS2 penetration testing

NIS2 penetration testing that evidences effectiveness

NIS2 doesn’t name penetration testing — but Article 21 requires you to prove your security measures work. A test turns that obligation into evidence a regulator accepts.

Get a quote See a sample report

Article 21 measuresNIS2 Directive

How testing evidences Article 21

21(2)(a)Risk analysis & security policies
21(2)(d)Supply-chain security
21(2)(e)Security in acquisition & development
21(2)(f)Measuring effectiveness

Evidence of effectivenessBoard-ready

01 · Where it fits

NIS2 never says “pentest”. It says “prove your measures work”

Article 21 requires risk-management measures and — in 21(2)(f) — policies to assess whether they’re effective. Penetration testing is how you evidence effectiveness instead of asserting it, which is what a regulator and your board will ask for.

Article 21

Measure

How a pentest evidences it

(2)(a)

Risk analysis and information-system security

Testing turns assumed risk into measured risk

(2)(e)

Security in acquisition, development and maintenance

Pre-release testing proves security was built in

(2)(f)

Policies to assess the effectiveness of measures

A pentest is direct evidence a control works, not just exists

(2)(d)

Supply-chain security

Testing extends to the third-party systems you rely on

Findings are written for a board and a regulator: what the risk was, what you did, and the evidence it’s closed.

Talk to a NIS2 consultant

02 · Who’s in scope

Essential and important entities — and their suppliers

NIS2 widened the net. If you’re a medium or large organisation in one of the covered sectors, you’re likely in scope — and so is the obligation to manage supply-chain risk.

Essential entities

In scope

Larger organisations in high-criticality sectors: energy, transport, banking, health, water, digital infrastructure.

Full supervisory regime
Senior management accountable
You get: effectiveness evidence they can sign off

Important entities

In scope

Medium and large organisations in other covered sectors, from manufacturing to digital providers.

Lighter-touch supervision
Still bound by Article 21
You get: proof your measures work

Your suppliers

By extension

Article 21 makes supply-chain security your responsibility, so testing often extends to key vendors.

Third-party risk in scope
Contractual testing rights
You get: assurance across the chain

Check if you’re in scope

Starting from€3,000

Priced on your in-scope systems

A NIS2 test is scoped to the systems that carry your risk. Network, web and cloud testing are scoped to the measures you need to evidence. See penetration testing pricing.

Get a fixed quote

04 · Questions

NIS2 penetration testing FAQ

Get a quote

More in our NIS2 penetration testing guide.

Does NIS2 require penetration testing?

Not by name. NIS2 Article 21 requires risk-management measures and, in 21(2)(f), policies to assess whether those measures are effective. A penetration test is the standard way to evidence effectiveness rather than assert it.

Is my organisation in scope for NIS2?

Likely, if you’re a medium or large organisation (roughly 50+ staff or €10M+ turnover) in a covered sector — energy, transport, banking, health, water, digital infrastructure, manufacturing, and more. Essential and important entities are both covered; your national transposition is the final word.

How does a pentest help with Article 21?

It evidences several measures at once: risk analysis (21(2)(a)), security in development (21(2)(e)) and, above all, the effectiveness assessment in 21(2)(f). The report shows a regulator that your controls work, not just that policies exist.

Does NIS2 make us responsible for our suppliers?

Yes. Article 21(2)(d) requires you to manage supply-chain security, so testing often extends to the key third-party systems you depend on, backed by contractual testing rights.

How does NIS2 relate to DORA?

DORA is the sector-specific regime for financial entities and is more prescriptive about testing. If you’re a financial entity, DORA takes precedence; otherwise NIS2 Article 21 applies. Some groups manage both.