NIS2 penetration testing: what Article 21 requires
NIS2 (Directive (EU) 2022/2555) does not name penetration testing. Article 21(2) requires measures that include policies and procedures to assess the effectiveness of risk-management measures, vulnerability handling, and supply chain security. A pentest is one way to produce evidence for those points. National laws and customer contracts may add detail, so confirm both.
NIS2 penetration testing is a common search, but the directive does not use the phrase. Directive (EU) 2022/2555 sets risk-management duties for essential and important entities. A pentest is one way to show that some of those duties work. This page lists the Article 21(2) points that touch testing and what to give a customer who asks.
Does NIS2 require a penetration test?#
No. The text of Article 21 requires "appropriate and proportionate technical, operational and organisational measures" and lists minimum topics. Penetration testing is not on the list. As of November 2026 we read Article 21 on an unofficial mirror of the directive because EUR-Lex blocked automated access. Check the wording on EUR-Lex before you rely on it in a legal document.
The European Commission describes NIS2 as setting common cybersecurity risk-management and incident reporting rules for medium and large organizations in key sectors. It entered into force in January 2023. The transposition deadline was 17 October 2024.
Who is in scope?#
NIS2 applies to "essential" and "important" entities. Article 21(1) puts the duty on those entities, and Member States must ensure they take the measures.
Which organization is which depends on sector and size, and each Member State transposes the directive in its own law. We do not name country-specific rules here, because they differ and we did not verify them. If you are unsure, ask counsel or your national authority.
Which parts of Article 21(2) relate to testing?#
Article 21(2) says the measures "shall include at least" ten items, (a) to (j). Four of them connect to a pentest.
| Article 21(2) point | Text (short) | How a pentest relates |
|---|---|---|
| (d) | Supply chain security, including relationships with direct suppliers | Customers ask suppliers for test evidence |
| (e) | Security in acquisition, development and maintenance, including vulnerability handling and disclosure | A test finds flaws in your own code and a retest checks the fix |
| (f) | Policies and procedures to assess the effectiveness of risk-management measures | A pentest tests whether controls work against an attacker |
| (j) | Multi-factor authentication or continuous authentication, where appropriate | Authentication testing checks it holds |
Article 21(4) adds that an entity that finds it does not comply must take corrective measures "without undue delay". A report with fixes and a retest is a record of that. Article 21(2) also covers incident handling, continuity, cryptography, access control and training, which a pentest does not replace.
Why do suppliers get pentest requests?#
Article 21(2)(d) makes supply chain security a required measure, and Article 21(3) says entities must take into account the vulnerabilities specific to each direct supplier and the overall quality of its cybersecurity practices, including secure development procedures.
In practice an in-scope customer sends its vendors a questionnaire or contract clause. A SaaS vendor then needs a recent test report, or a summary of one. See security questionnaire pentest questions for the usual wording and customer security review for how we help with that request.
What does a pentest add to the evidence file?#
A pentest gives dated proof that a qualified person tried to break a defined scope. Use it next to other evidence, not instead of it.
- The scope and the date of the test.
- The method, including which accounts and roles the tester used.
- Findings with evidence and severity.
- Fix status and the retest result. See retesting.
- Limits: what the test did not cover.
Record why you chose the scope and the interval. Article 21 turns on proportionality, so the reasoning is part of the evidence.
How do you scope a test that supports Article 21?#
Scope the systems that carry the entity's service and the data customers send you. For a SaaS vendor that is usually the web app, the API and the tenant boundary. Write the reason for each scope choice next to the Article 21(2) point it supports.
| Customer request | Scope choice | Evidence to keep |
|---|---|---|
| "Show how you assess control effectiveness" (point f) | Authenticated test of the app and API | Report with controls that held |
| "Show how you handle vulnerabilities" (point e) | Test, fix log and retest | Retest result with dates |
| "Show supplier assurance" (points d and 21(3)) | Summary or letter for the customer | Scope, date and method |
Demonstration only
This table is a demonstration of how to map requests to evidence. No real customer system was tested, and no regulator has approved this mapping.
Ask the customer which of its Article 21(2) points the request supports. The answer tells you how much detail to send, and it often shows that a summary is enough.
Why do national rules differ?#
A directive binds Member States to a result, and each state writes its own law. Penalties, sector lists, registration steps and guidance can vary. Treat the directive as the floor and read the law of each state where you or your customers operate.
How does NIS2 compare with DORA?#
DORA (Regulation (EU) 2022/2554) applies to financial entities and has its own testing rules, including threat-led penetration testing for entities the authorities pick. A SaaS vendor is not subject to that testing unless it is itself a financial entity. See DORA penetration testing. For personal data duties, see GDPR penetration testing.
What can you send a customer who asks for NIS2 evidence?#
Send a short package, and do not promise acceptance.
- A test summary or an attestation letter. See pentest attestation letter.
- The date, scope and method of the last test.
- Count of findings by severity and how many are fixed.
- The date of the retest.
No regulator or customer is bound to accept any report, so ask what they need before you send it.
Judge us by the report
Every finding comes with the request, the response, the impact and a fix. See the demonstration report.
Questions
Is a penetration test mandatory under NIS2?
The directive text does not name penetration testing. Article 21(2)(f) requires policies and procedures to assess the effectiveness of cybersecurity risk-management measures. How an entity meets that is a risk decision. Check your national law and your regulator's guidance.
Does NIS2 apply to a SaaS company outside the EU?
Scope depends on the sector, the size and where services are provided, and the national law decides details. Even when you are not in scope, a customer that is in scope may pass security requirements to you through its contract.
How often should we test for NIS2?
The directive gives no interval. Article 21 asks for measures that are appropriate and proportionate to the risk. Many teams test yearly and after major releases, and record the reason for the interval they choose.
Can one pentest report serve NIS2 customers and other audits?
Often a report can support several requests, but no regulator or auditor is bound to accept it. Send the scope, date, method and fix status, and ask each reviewer what it needs.
Sources
- European Commission: NIS2 Directive (checked 9 November 2026)
- NIS 2 Directive, Article 21 text (unofficial mirror of Directive (EU) 2022/2555; verify on EUR-Lex) (checked 9 November 2026)
- EUR-Lex: Directive (EU) 2022/2555 (NIS2) (checked 9 November 2026)