Skip to content

NIS2 penetration testing: evidence that holds up in an audit

NIS2 doesn’t just require security measures. It requires proof that they work. A penetration test provides exactly that proof: documented, dated and confirmed by a retest.

See my NIS2 fixed price

Prefer to talk first? Book a call

To be clear: we don’t certify. We deliver the audit-ready test results your auditor, certification body or customer wants to see.

What NIS2 requires

Germany’s NIS2 implementation act (NIS2UmsuCG) has applied since 6 December 2025, with no transition period. An estimated 29,500 entities in Germany are in scope.

  • Risk-management measures

    In-scope entities must implement appropriate technical and organisational measures (Art. 21 NIS2 Directive), including vulnerability handling, secure development and supply-chain security.

  • Assess effectiveness

    The directive explicitly requires policies and procedures to assess the effectiveness of those measures (Art. 21(2)(f)). Penetration testing is the established way to do that.

  • Management accountability

    Management bodies must approve the measures and oversee their implementation (Art. 20). A pentest report with an executive summary gives them a solid basis.

  • Fines

    Up to €10 million or 2% of worldwide annual turnover for essential entities, up to €7 million or 1.4% for important entities (Art. 34).

Directive (EU) 2022/2555 (NIS2) · BSI: NIS-2 regulated entities

Who is affected

Generally medium and large companies (typically 50+ employees, or more than €10 million annual turnover and balance-sheet total) in the sectors listed in the NIS2 Directive, e.g. energy, transport, health, digital infrastructure and services, manufacturing, food, waste, chemicals and postal services. The BSI offers a check to find out whether your company is in scope.

BSI: NIS-2 regulated entities (German)

How a pentest report serves as evidence

  • Documented scope, timeframe and methodology (OWASP, PTES, BSI guidance)
  • Executive summary for management
  • Findings with CVSS 3.1 rating, risk and recommendation
  • Retest confirmation: proof that measures were implemented
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub: remediation you can trace
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
  • Repeatable for an annual testing cycle
See my NIS2 fixed price

One test, many pieces of evidence

Many standards require regular technical testing. We align scope and report so one test covers several requirements.

  • NIS2

    Assessing the effectiveness of cybersecurity risk-management measures (Art. 21(2)(f) NIS2 Directive).

  • ISO/IEC 27001:2022

    Annex A 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance).

    Pentest for ISO 27001

  • SOC 2

    Evidence for the Trust Services Criteria on monitoring and vulnerability detection (e.g. CC4.1, CC7.1), often requested by enterprise customers.

  • TISAX®

    Evidence for the VDA ISA catalogue requirements on handling technical vulnerabilities, for automotive suppliers.

    TISAX pentest

  • PCI DSS 4.0

    Requirement 11.4: internal and external penetration testing at least annually and after significant changes, including segmentation testing.

  • DORA

    Regular digital operational resilience testing (Art. 24–25), e.g. penetration tests. Note: we do not offer TLPT under Art. 26.

  • GDPR Art. 32

    A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures (Art. 32(1)(d)).

  • BSI IT-Grundschutz

    Methodology aligned with BSI guidance for penetration tests; results feed directly into your ISMS.

See my fixed price

Prefer to talk first? Book a call

NIS2 and penetration testing: FAQ

Does NIS2 require a penetration test?
NIS2 doesn’t name “penetration test” as a mandatory term, but it requires procedures to assess whether security measures are effective. In practice, a penetration test is the usual evidence auditors expect.
How often should we test?
At least once a year and after significant changes (new applications, infrastructure changes, migrations) is common practice. PCI DSS mandates exactly this rhythm.
Do we get a NIS2 certificate?
No. There is no general NIS2 certificate, and we don’t certify. You get an audit-ready report, a retest confirmation and a one-page attestation letter as evidence.
Which systems should we test for NIS2?
Start with the systems attackers are most likely to get in through: internet-facing services, remote access and business-critical applications, then the internal network. Typical tests: Web application pentest, External network pentest, Internal network pentest and Active Directory pentest. We prioritise together in the free scoping call.
We are a supplier. Does NIS2 affect us anyway?
Even if you are not in scope yourself, in-scope customers increasingly ask suppliers for evidence (supply-chain security, Art. 21). A recent pentest report answers many of those requests.

What should we test?

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call