NIS2 penetration testing: what German companies actually need

Since 6 December 2025, Germany’s NIS2 implementation act (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz, NIS2UmsuCG) has applied, without a transition period. An estimated 29,500 entities in Germany are in scope. Many of them are asking the same question: do we now need a penetration test, and what exactly should it cover?

What NIS2 actually says about testing

The NIS2 Directive (EU) 2022/2555 requires essential and important entities to take “appropriate and proportionate technical, operational and organisational measures” to manage cybersecurity risks (Art. 21). The list of minimum measures includes, among others:

• policies on risk analysis and information system security,
• incident handling and business continuity,
• supply-chain security,
• security in acquisition, development and maintenance of systems, including vulnerability handling,
• policies and procedures to assess the effectiveness of cybersecurity risk-management measures (Art. 21(2)(f)).

That last point is the key. It is not enough to have a firewall, MFA or a patch process. You must be able to show that these measures work. A penetration test does exactly that: it checks, from an attacker’s perspective, whether your controls stop a real attack.

Management is accountable

Under Art. 20, management bodies must approve the risk-management measures and oversee their implementation, and they can be held liable for failures. A pentest report with a clear executive summary gives management a defensible basis for those decisions: what was tested, what was found, what was fixed.

Who is in scope?

In general, medium-sized and large companies (typically from 50 employees, or more than €10 million annual turnover and balance-sheet total) in the sectors listed in the directive: energy, transport, health, digital infrastructure and services, manufacturing, food, chemicals, waste management and more. The BSI offers an online check to find out whether your company is affected.

Not in scope yourself? If your customers are, you will likely receive supplier security questionnaires: supply-chain security is part of their obligations. A recent pentest report answers many of those questions.

How to plan a NIS2-ready penetration test

1. Start where attackers start. Internet-facing systems (VPN gateways, remote access, mail, web applications and APIs) are the most common entry points. Test those first.
2. Then test what happens after a breach. An internal network and Active Directory test shows how far an attacker gets once inside: the path ransomware groups take.
3. Cover your critical business applications. Customer portals, ERP integrations and SaaS products often hold the data that matters most.
4. Document scope and methodology. Auditors want to see what was tested, when, how and against which standard (e.g. OWASP, PTES, BSI guidance).
5. Close the loop with a retest. Evidence of fixed findings is worth more than a list of open ones. A retest confirmation shows your measures now work.
6. Repeat. Plan an annual cycle plus tests after significant changes.

What makes a pentest report audit-ready

A report that holds up in an audit has:

• a defined scope, timeframe and test type,
• a methodology section referencing recognised standards,
• an executive summary for management,
• findings with severity (e.g. CVSS 3.1), business risk, evidence and remediation,
• a retest confirmation with dates.

This also maps to other frameworks many companies have to satisfy at the same time: ISO 27001 (Annex A 8.8 and 8.29), SOC 2, TISAX or PCI DSS. One well-scoped test can serve several audits. We explain how on our NIS2 & compliance page.

Bottom line

NIS2 asks for proof that your security works. A penetration test is the most direct proof, if it is scoped to your real risks, documented properly and followed by a retest. If you are unsure where to start, a short scoping call usually answers the question in 30 minutes.