--- title: "NIS2 Penetration Testing: Audit-Ready Evidence | Mr Cyber" url: https://mr-cyber.com/nis2-penetration-testing language: en description: "NIS2 penetration testing for companies in Germany and the EU: audit-ready evidence for NIS2, ISO 27001, SOC 2, TISAX, PCI DSS and DORA. Fixed price." --- # NIS2 penetration testing: evidence that holds up in an audit NIS2 doesn’t just require security measures. It requires proof that they work. A penetration test provides exactly that proof: documented, dated and confirmed by a retest. [See my NIS2 fixed price](https://mr-cyber.com/quote) Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book) To be clear: we don’t certify. We deliver the audit-ready test results your auditor, certification body or customer wants to see. ## What NIS2 requires Germany’s NIS2 implementation act (NIS2UmsuCG) has applied since 6 December 2025, with no transition period. An estimated 29,500 entities in Germany are in scope. - ### Risk-management measures In-scope entities must implement appropriate technical and organisational measures (Art. 21 NIS2 Directive), including vulnerability handling, secure development and supply-chain security. - ### Assess effectiveness The directive explicitly requires policies and procedures to assess the effectiveness of those measures (Art. 21(2)(f)). Penetration testing is the established way to do that. - ### Management accountability Management bodies must approve the measures and oversee their implementation (Art. 20). A pentest report with an executive summary gives them a solid basis. - ### Fines Up to €10 million or 2% of worldwide annual turnover for essential entities, up to €7 million or 1.4% for important entities (Art. 34). [Directive (EU) 2022/2555 (NIS2)](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) · [BSI: NIS-2 regulated entities](https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html) ## Who is affected Generally medium and large companies (typically 50+ employees, or more than €10 million annual turnover and balance-sheet total) in the sectors listed in the NIS2 Directive, e.g. energy, transport, health, digital infrastructure and services, manufacturing, food, waste, chemicals and postal services. The BSI offers a check to find out whether your company is in scope. [BSI: NIS-2 regulated entities (German)](https://www.bsi.bund.de/DE/Themen/Regulierte-Wirtschaft/NIS-2-regulierte-Unternehmen/nis-2-regulierte-unternehmen_node.html) ## How a pentest report serves as evidence - Documented scope, timeframe and methodology (OWASP, PTES, BSI guidance) - Executive summary for management - Findings with CVSS 3.1 rating, risk and recommendation - Retest confirmation: proof that measures were implemented - Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub: remediation you can trace - Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42 - Repeatable for an annual testing cycle [See my NIS2 fixed price](https://mr-cyber.com/quote?service=unsure&driver=nis2) ## One test, many pieces of evidence Many standards require regular technical testing. We align scope and report so one test covers several requirements. - ### NIS2 Assessing the effectiveness of cybersecurity risk-management measures (Art. 21(2)(f) NIS2 Directive). - ### ISO/IEC 27001:2022 Annex A 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance). [Pentest for ISO 27001](https://mr-cyber.com/iso-27001-penetration-testing) - ### SOC 2 Evidence for the Trust Services Criteria on monitoring and vulnerability detection (e.g. CC4.1, CC7.1), often requested by enterprise customers. - ### TISAX® Evidence for the VDA ISA catalogue requirements on handling technical vulnerabilities, for automotive suppliers. [TISAX pentest](https://mr-cyber.com/tisax-penetration-testing) - ### PCI DSS 4.0 Requirement 11.4: internal and external penetration testing at least annually and after significant changes, including segmentation testing. - ### DORA Regular digital operational resilience testing (Art. 24–25), e.g. penetration tests. Note: we do not offer TLPT under Art. 26. - ### GDPR Art. 32 A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures (Art. 32(1)(d)). - ### BSI IT-Grundschutz Methodology aligned with BSI guidance for penetration tests; results feed directly into your ISMS. ## NIS2 and penetration testing: FAQ Does NIS2 require a penetration test? NIS2 doesn’t name “penetration test” as a mandatory term, but it requires procedures to assess whether security measures are effective. In practice, a penetration test is the usual evidence auditors expect. How often should we test? At least once a year and after significant changes (new applications, infrastructure changes, migrations) is common practice. PCI DSS mandates exactly this rhythm. Do we get a NIS2 certificate? No. There is no general NIS2 certificate, and we don’t certify. You get an audit-ready report, a retest confirmation and a one-page attestation letter as evidence. Which systems should we test for NIS2? Start with the systems attackers are most likely to get in through: internet-facing services, remote access and business-critical applications, then the internal network. Typical tests: [Web application pentest](https://mr-cyber.com/services/web-application-penetration-testing), [External network pentest](https://mr-cyber.com/services/external-network-penetration-testing), [Internal network pentest](https://mr-cyber.com/services/internal-network-penetration-testing) and [Active Directory pentest](https://mr-cyber.com/services/active-directory-penetration-testing). We prioritise together in the free scoping call. We are a supplier. Does NIS2 affect us anyway? Even if you are not in scope yourself, in-scope customers increasingly ask suppliers for evidence (supply-chain security, Art. 21). A recent pentest report answers many of those requests.