NIS2 Directive: penetration testing and the evidence it leaves
NIS2 does not ask you to pass a test. It asks for risk-management measures that are appropriate and proportionate, for policies to assess whether they work, for vulnerability handling, and for your management body to approve and oversee all of it. Through the supply-chain duty it reaches your suppliers and, if you are one, your customers' questionnaires. "Assess whether they work" is the part a scanner cannot do for you. Attack the estate, fix what would breach it, re-test, and keep the record.
When it applies.
- 01Entered into forcemilestone
- 02Transposition deadlineThe date that matters
JurisdictionEuropean Union, applied through the national law of each member state. The transposition deadline was 17 October 2024.
In scope, and out.
- Essential and important entities in the sectors listed in Annexes I and II, among them energy, transport, banking, financial market infrastructure, health, water, digital infrastructure, ICT service management, public administration and space, and postal services, waste, chemicals, food, manufacturing, digital providers and research, generally medium-sized and above, with exceptions.
- Through Article 21(2)(d), the suppliers and service providers of those entities, whom the entity must assess, which is how mid-market suppliers meet NIS2 in their customers' due diligence.
- The detail sits in national law, which varies in registration, timing and penalties.
What it asks of you
Article 21 is the heart of it. Entities must take appropriate and proportionate measures to manage the risks to their network and information systems, across at least ten areas, two of which are the business of this page: security in acquisition, development and maintenance, including vulnerability handling, and policies and procedures to assess the effectiveness of the measures taken. A third, supply chain security, is how the Directive travels from the entities named in its annexes to the companies that sell to them. Article 20 puts the management body in charge of approving and overseeing the measures and makes it answerable for failures. Article 23 sets the reporting clock for significant incidents: 24 hours, 72 hours, one month.
None of that says “penetration test”. All of it assumes you know whether your measures hold, and the only way to know is to test them the way an attacker would and act on what you find.
What the evidence looks like
A NIS2 record has two readers. The first is your own management body, which has to approve measures it can understand and oversee results it can see. The second is whoever assesses you, a regulator or a customer running supplier due diligence. Both want the same thing in different words: what was tested, what was found and proven, what was fixed, that the fix was re-tested, and what was deliberately not fixed and why. That last list is where “proportionate” becomes visible, and it is why we write it down instead of leaving it as an absence.
The obligations testing can answer.
- Article 21(1) and 21(2)
Appropriate and proportionate technical, operational and organisational measures to manage the risks to network and information systems, under an all-hazards approach, covering at least ten listed areas.
The test of a measure is whether it holds against an attacker. We attack it, and the result is a list of what would breach you rather than a list of what is configured.
Penetration testing; Incenter - Article 21(2)(e)
Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.
Findings with proof, the fix with your team, and the re-test. Vulnerability handling with an end to it.
Incenter; closure sprint - Article 21(2)(f)
Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
Testing is the effectiveness assessment, continuous through Incenter and periodic through penetration tests, with evidence either way.
Incenter; penetration testing - Article 21(2)(d)
Supply chain security, including the vulnerabilities specific to each direct supplier and the overall quality of their practices.
For an entity, the evidence to ask suppliers for. For a supplier, the evidence to have ready before the questionnaire arrives, which is tested, fixed and re-tested.
Penetration testing; Incenter - Article 20
Management bodies approve the measures, oversee their implementation, follow training, and can be held liable for infringements.
A summary a board can read and act on, with what would have breached the organisation, what was fixed, what was re-tested and what was deliberately left.
Every engagement - Article 23
Report significant incidents with an early warning within 24 hours, a notification within 72 hours and a final report within one month.
Fewer incidents to report is the point. A known estate with proven findings is also what makes a 72-hour notification writable.
Incenter
The record you can hand over.
- A report per test with each finding, its proof, the fix, the re-test and the named testers.
- The list of what we recommended not fixing, with the reasons, which is what "proportionate" looks like on paper.
- A one-page summary for the management body.
- The same evidence written for a customer's supplier assessment, when you are the supplier.
NIS2, answered plainly.
Does NIS2 require penetration testing?
Not by name. It requires measures and a way to assess whether they are effective (Article 21(2)(f)). Testing is how most entities show that, and how national guidance generally reads it; your counsel confirms the position in your member state.
We are a supplier, not an essential entity. Why does it reach us?
Article 21(2)(d) makes your customers responsible for the security of their supply chain, including the vulnerabilities specific to you and the quality of your practices. They assess you, and they ask for evidence.
Which national law applies to us?
The law of the member state where you are established or provide services. The Directive sets the floor and the national law adds registration, timing and penalties. The evidence we leave is the same in every state.
How often should we test?
The Directive says appropriate and proportionate and leaves the cadence to your risk assessment and national guidance. Continuous testing of the exposed surface with a penetration test each year or after each major change is the pattern we see accepted.
How does testing help with Article 20?
It gives the management body something concrete to approve and oversee, a ranked list of what would breach the organisation, what was fixed and what was re-tested, instead of a policy document.