DigiD Penetration Testing (DigiD Security Assessment)
The DigiD security assessment is performed by senior testers; the report follows the Logius Normenkader and is ready within 5 business days.
What is tested and why it matters
Validating the security of DigiD connections against the Normenkader.
Every Dutch organisation that connects to DigiD for citizen authentication is required by Logius to complete an annual security assessment. The assessment must follow the DigiD Normenkader and cover the web application, authentication mechanisms, session handling, and supporting infrastructure. Non-compliance can result in disconnection from DigiD, which directly prevents citizens from accessing digital government services. The assessment is not optional and must be completed annually, regardless of whether changes have been made to the application or infrastructure. Findings must be reported to Logius in the prescribed format.
Who needs this assessment
Organisations that benefit most.
This assessment is designed for Dutch organisations that connect to DigiD and must complete the mandatory annual security assessment required by Logius.
Dutch municipalities (gemeenten) offering digital services with DigiD authentication
Healthcare providers and health insurers using DigiD for patient or insured access
Tax authorities, pension funds, and social security organisations
Educational institutions and other public sector bodies connected to DigiD
Commercial service providers operating DigiD connections on behalf of government organisations
Healthcare institutions providing patient portals or appointment systems that authenticate via DigiD
Where compliance-focused assessments apply
- Financial services: PCI-DSS validation for cardholder data environments and payment processing systems.
- Government and public administration: DigiD assessments and alignment with BIO and NIS2 requirements.
- Healthcare: demonstrating security controls for patient data systems under NIS2 and ISO 27001.
- Critical infrastructure: energy, transport, and water supply organisations subject to NIS2 Article 21.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering technical findings, severity ratings, evidence, and remediation guidance in the format required by Logius. Reports are delivered through the Pentrox Portal and are available for download at any time.
- Compliance with the Logius DigiD annual assessment requirement
- Findings documented in the format required for Logius compliance reporting
- Identified vulnerabilities in the DigiD connection, authentication flow, and supporting infrastructure
- Remediation guidance enabling the organisation to resolve findings before the Logius reporting deadline
- Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from Normenkader mapping through verified remediation.
Each phase builds on the previous one. Normenkader scope mapping defines mandatory test areas, authentication and application testing validate the DigiD connection, and Logius-format reporting supports compliance submission.
Normenkader scope mapping
The application, authentication flow, supporting infrastructure, and network boundaries are mapped against the Logius DigiD Normenkader requirements.
Logius DigiD Normenkader, BIO (Baseline Informatiebeveiliging Overheid)Authentication and session testing
The DigiD authentication flow is assessed from login through session establishment. SAML and OIDC integration, token handling, and timeouts are validated.
Logius DigiD Normenkader (authentication norms), OWASP WSTGWeb application security testing
Web application testing uses Nessus, Burp Suite, and manual assessment. Input validation, access control, and error handling are validated per the Normenkader.
OWASP WSTG, OWASP Top 10, Logius DigiD Normenkader (application norms)Infrastructure and configuration review
Supporting infrastructure is assessed for misconfigurations and outdated software. TLS, HTTP security headers, and server hardening are validated against BIO.
BIO (Baseline Informatiebeveiliging Overheid), Logius DigiD NormenkaderLogius-format reporting
Findings are documented with evidence, a CVSS score and the risk classification in the Logius-required format. Critical findings are communicated immediately.
Logius DigiD Normenkader (reporting requirements)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact DigiD-connected systems and supporting infrastructure before the assessment begins. The lists below reflect the standard scope for a DigiD penetration test.
In scope
- Web application connected to DigiD
- DigiD authentication flow (SAML or OpenID Connect integration)
- Session management and timeout configuration
- Supporting web server and infrastructure components
- TLS configuration and HTTP security headers
- Logging and monitoring of authentication events
- Privacy and data protection controls for citizen data
Out of scope
- Logius DigiD infrastructure itself (the DigiD identity provider)
- Applications or systems not connected to the DigiD authentication flow
- Denial-of-service testing against production systems unless explicitly agreed
- Organisational policy and governance review (non-technical BIO requirements)
What you receive
- Executive summary Security posture overview, severity distribution, and remediation priorities written for organisational leadership.
- Detailed findings Each vulnerability documented with evidence, reproduction steps, CVSS severity rating, and Normenkader requirement mapping.
- Logius-format compliance report Structured for direct submission to Logius, using the prescribed finding categories and severity classifications.
- Remediation plan Prioritised by severity and Logius reporting deadline for efficient resolution.
- Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
- Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
- Retest report Verification results after remediation, documenting each finding with its updated status.
Read more
Why the report is the real deliverable
What a strong report contains for the board and for the developer.
Retesting: how a fix is proven
What a retest checks, the three outcomes, and why the record matters in an audit.
NIS2 penetration testing
For organisations that also fall under the Cyberbeveiligingswet; the same penetration test provides the evidence for the Article 21 measures.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a DigiD penetration test depends on the complexity of the web application, the number of DigiD-connected services, and the scope of supporting infrastructure. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.
What determines duration
- Complexity of the web application connected to DigiD
- Number of DigiD-connected services and authentication flows
- Scope of supporting infrastructure (web servers, network components)
- Whether the application uses SAML, OpenID Connect, or both
- Whether testing is performed in a production or non-production environment
Actual duration is confirmed during scoping and depends on application complexity and the number of DigiD-connected services. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.
Why Pentrox
The operational standards behind every DigiD assessment.
These operational standards apply to every DigiD assessment Pentrox delivers, regardless of application complexity or number of connected services.
Logius Normenkader alignment
Testing follows the prescribed framework.
The assessment scope, methodology, and reporting follow the Logius DigiD Normenkader. Findings use the prescribed severity classifications for direct Logius submission.
Annual assessment continuity
Consistent testing, year after year.
Pentrox maintains assessment records across annual cycles. Year-over-year comparison supports efficient scoping and focused attention on changes since the previous assessment.
Dutch government context
Familiar with BIO and public sector requirements.
The assessment is conducted with knowledge of the BIO, DigiD connection architecture, and Dutch public sector reporting obligations. This context reduces scoping time.
Portal-delivered results
Findings visible in real time, not buried in a PDF delivered weeks later.
The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Role-based access control is enforced on every account.
Retest included
Verified remediation before the Logius deadline.
Remediated findings are flagged through the Portal and scheduled for verification. Each finding is re-evaluated individually. Retest cycles repeat until all findings are resolved.
Frequently asked questions
Practical answers for security teams and procurement officers.
Is this assessment mandatory?
Logius requires every organisation connected to DigiD to complete an annual security assessment. The assessment must follow the DigiD Normenkader and findings must be reported to Logius. Non-compliance can result in disconnection from DigiD.
Does the report satisfy Logius reporting requirements?
The report follows the format prescribed by Logius for DigiD compliance reporting. Findings are categorised using the required severity classifications, and the report is structured for direct submission.
Is retesting included, and at what cost?
Retesting of remediated findings is included as standard with every assessment. There are no additional charges for verifying that fixes have been implemented correctly. The retest process is managed through the Pentrox Portal, where the client can flag remediated findings and request a retest.
What clearances do the testers hold?
All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers with extensive hands-on experience.
Can Pentrox perform the assessment before the Logius deadline?
Assessment scheduling takes the Logius reporting deadline into account. Accelerated timelines can be discussed during the intake phase to ensure the assessment and any required retesting are completed before the submission date.
Is the assessment conducted in Dutch or English?
Reports can be delivered in English or Dutch. Communication during the assessment is available in both languages. The Logius submission report follows the prescribed Dutch-language format where required.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
What happens when a critical vulnerability is found during testing?
Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.
What is the Norm ICT-beveiligingsassessments DigiD?
It is the set of requirements Logius applies to every DigiD connection. The requirements come from the NCSC guidelines for secure web applications (ICT-beveiligingsrichtlijnen voor webapplicaties). Each requirement has a code, and one of them is a yearly penetration test of the connected web application. The Pentrox report follows those codes, so the auditor can link every finding to a requirement.
Who performs the DigiD assessment: the pentester or the auditor?
Both, each with their own role. Pentrox performs the penetration test and delivers the report. An independent IT auditor (Register EDP-auditor) then assesses all requirements and writes the assessment report that your organisation submits to Logius. The pentest is planned so the auditor can finish before the date Logius sets for your connection.
Related assessment categories
Application Security
Web, API, and mobile application assessments beyond the DigiD connection scope.
Infrastructure Security
Network infrastructure and server hardening for the environment supporting DigiD-connected services.
Compliance and Standards
ISO 27001, NIS2, and PCI-DSS assessments against a defined control framework.