NIS2 Penetration Testing: Evidence for the Duty of Care
A NIS2 penetration test provides evidence for the measures in NIS2 Article 21; a retest within 90 days is included.
What is tested and why it matters
Validating the technical controls required by NIS2 Article 21.
The NIS2 Directive applies to essential and important entities across critical sectors in the EU, including energy, transport, banking, health, water supply, digital infrastructure, and public administration. Article 21 requires these organisations to take appropriate technical and organisational measures to manage cybersecurity risks. Compliance is not optional: management bodies can be held personally liable for failures to implement adequate security measures. A penetration test aligned with NIS2 requirements identifies gaps in technical controls before a supervisory authority or a real attacker discovers them. Without independent validation, an organisation cannot demonstrate that its risk management measures are effective.
Who needs this assessment
Organisations that benefit most.
This assessment is designed for entities classified under NIS2 that must demonstrate adequate technical security measures to supervisory authorities and management boards.
Essential entities under NIS2: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration, space
Important entities under NIS2: postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research
Organisations in the supply chain of essential or important entities
Dutch organisations preparing for the national transposition of NIS2 (Cbw, Cyberbeveiligingswet)
Organisations that must demonstrate due diligence in cybersecurity to management boards and supervisory authorities
Healthcare institutions, energy providers, and critical infrastructure operators classified as essential entities under NIS2
Where compliance-focused assessments apply
- Financial services: PCI-DSS validation for cardholder data environments and payment processing systems.
- Government and public administration: DigiD assessments and alignment with BIO and NIS2 requirements.
- Healthcare: demonstrating security controls for patient data systems under NIS2 and ISO 27001.
- Critical infrastructure: energy, transport, and water supply organisations subject to NIS2 Article 21.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering technical findings, severity ratings, evidence, and remediation guidance mapped to NIS2 Article 21 requirements. Reports are delivered through the Pentrox Portal and are available for download at any time.
- Independent validation that technical security controls meet NIS2 Article 21 requirements
- Identified gaps in network security, access control, and incident response readiness
- Supply chain risk exposure assessed against NIS2 supply chain security provisions
- Reporting structured for supervisory authority review and board-level governance
- Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from risk mapping through verified remediation.
Each phase builds on the previous one. Risk landscape mapping defines priority systems, network testing validates controls, and incident detection validation confirms monitoring effectiveness.
Risk landscape and scope definition
Critical systems and data flows are mapped. The scope is aligned with the entity classification and NIS2 risk management requirements for the sector.
NIS2 Directive Article 21, ENISA NIS2 Technical Implementation GuidanceNetwork and information system testing
External and internal network assessments probe segmentation and service exposure. Nessus and Burp Suite scans are manually verified for exploitability.
NIST SP 800-115, PTES, OSSTMMAccess control and identity assessment
Authentication mechanisms, privilege models, and MFA effectiveness are tested. Weak or excessive access is documented with impact on service continuity.
NIS2 Article 21(2)(d), ENISA NIS2 Technical Implementation GuidanceIncident detection and response validation
Security monitoring is evaluated for detection of attack techniques performed during testing. Gaps are reported with the relevant ATT&CK technique reference.
NIS2 Article 21(2)(b), MITRE ATT&CKReporting with NIS2 mapping
Findings are documented with evidence, a CVSS score, and NIS2 Article 21 mapping. Critical findings are communicated immediately during testing.
NIS2 Directive Article 21, ENISA NIS2 Technical Implementation GuidanceScope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact systems, network zones, and testing approach before the assessment begins. The lists below reflect the standard scope for a NIS2 penetration test.
In scope
- External and internal network infrastructure supporting critical services
- Web applications and APIs processing or exposing critical data
- Access control and authentication mechanisms
- Network segmentation and isolation controls
- Security monitoring and incident detection capabilities
- Supply chain access points and third-party integrations
- Business continuity and crisis management technical controls
Out of scope
- Organisational governance and policy review (non-technical NIS2 requirements)
- Physical security controls (available as a separate mystery guest assessment)
- Third-party infrastructure not under the organisation's administrative control
- Denial-of-service testing against production systems unless explicitly agreed
What you receive
- Executive summary Cyber resilience posture, severity distribution, and remediation priorities written for leadership and supervisory authorities.
- Detailed findings Each vulnerability documented with evidence, reproduction steps, CVSS severity rating, and NIS2 Article 21 requirement mapping.
- Incident detection gap analysis Documenting which attack techniques executed during testing were detected and which were not.
- Remediation plan Prioritised by exploitability and critical service impact for efficient resolution.
- Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
- Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
- Retest report Verification results after remediation, documenting each finding with its updated status.
Read more
NIS2 and penetration testing
What the zorgplicht requires and which Article 21 measures a penetration test evidences.
How often should you have a penetration test?
At least yearly and after every major change; what NIS2, ISO 27001 and PCI DSS ask for.
Retesting: how a fix is proven
What a retest checks, the three outcomes, and why the record matters in an audit.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a NIS2 penetration test depends on the number of critical systems in scope, the complexity of network architecture, and whether supply chain access points are included. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.
What determines duration
- Number of critical systems and network zones in scope
- Entity classification (essential or important) and applicable NIS2 requirements
- Whether supply chain access points and third-party integrations are included
- Complexity of network segmentation and isolation architecture
- Whether incident detection validation is included in scope
Actual duration is confirmed during scoping and depends on entity classification and infrastructure complexity. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.
Why Pentrox
The operational standards behind every NIS2 assessment.
These operational standards apply to every NIS2 assessment Pentrox delivers, regardless of entity classification or infrastructure scope.
NIS2 Article 21 mapping
Findings tied to directive requirements.
Every finding references the specific NIS2 Article 21 sub-requirement it relates to. Reports support direct use during supervisory authority review.
Entity-aware scope calibration
Scope adjusted to essential or important classification.
Testing depth, system prioritisation, and reporting detail reflect the proportionality requirements of the NIS2 directive for the specific entity type.
Incident detection validation
Detection gaps identified during testing.
The assessment evaluates whether monitoring detected the attack techniques performed during testing. Gaps are documented with MITRE ATT&CK technique references.
Portal-delivered results
Findings visible in real time, not buried in a PDF delivered weeks later.
The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Role-based access control is enforced on every account.
Retest included
Verification that fixes are effective, at no additional cost.
Remediated findings are flagged through the Portal and scheduled for verification. Each finding is re-evaluated individually. Retest cycles repeat until all findings are resolved.
Frequently asked questions
Practical answers for security teams and procurement officers.
What is NIS2 and what is the Cyberbeveiligingswet?
NIS2 is the European directive on network and information security. The Netherlands has implemented it in the Cyberbeveiligingswet (Cbw), which has been in force since 15 August 2026 with no transition period. Roughly 8,000 organisations in 18 sectors are in scope. The Cbw sets three duties, namely registration, a duty of care and a reporting duty. No letter is sent; each organisation determines for itself whether it is in scope and registers at mijn.ncsc.nl.
Is a NIS2 penetration test mandatory?
Neither NIS2 nor the Cyberbeveiligingswet makes a penetration test mandatory by name. Article 21 of NIS2 requires ten minimum measures, including measure (f), policies to assess the effectiveness of measures. An organisation must show that its measures work; periodic testing provides that proof. The NCSC guideline 'Testen van technische veiligheidsmaatregelen' of 17 July 2025 names penetration tests, vulnerability assessments and code review as the ways to test. A NIS2 penetration test provides the evidence a supervisor can request.
Which Article 21 measures does a penetration test cover?
Article 21 of NIS2 lists ten minimum measures. A penetration test provides evidence for three of them. For measure (e), secure development and vulnerability handling, a penetration test shows which vulnerabilities exist and whether they have been fixed. For measure (f), policies to assess the effectiveness of measures, the report shows whether the measures work. For measure (d), supply chain security, the test covers supplier connections and supplier access. The report maps every finding to these measures.
Is NIS2 certification mandatory?
No. There is no official NIS2 certificate. Neither NIS2 nor the Cyberbeveiligingswet requires certification against ISO/IEC 27001 or NEN 7510. What the law does require is that the ten measures of Article 21 are in place and that the organisation can show that they work; that is measure (f). A supervisor may inspect, audit and request evidence. A penetration test delivers that evidence with reproduction steps, so the organisation can show without a certificate that its technical measures hold.
What is a NIS2 audit and what does a supervisor ask for?
A supervisor may inspect, audit and request evidence that the measures of Article 21 are in place and work. A NIS2 audit is a supervisory check on the three duties, registration, duty of care and reporting, not a certification process. The duty of care requires evidence; which measures were taken, how they were tested and what was done with the results. A penetration test report with findings, reproduction steps and retest results is evidence that can be handed over.
Is a NIS2 scan the same as a penetration test?
No. A vulnerability scan searches automatically for known vulnerabilities and produces a list of issues. A penetration test is manual work by senior testers; they exploit vulnerabilities, chain findings into an attack path and deliver evidence with reproduction steps. The NCSC guideline of 17 July 2025 names both as ways to test technical measures, alongside code review. Measure (f) of Article 21 asks for evidence that measures work; a scan gives a signal, a penetration test gives that evidence.
What must the board do under NIS2?
Article 24 of the Cyberbeveiligingswet places responsibility with the board. The board approves the measures of Article 21 and oversees their implementation. There is also a knowledge requirement; every board member must meet it within two years of the law taking effect, so by 15 August 2028. The board must be able to show that the measures work. A penetration test report with findings, priorities and retest results gives the board that evidence, which a supervisor can also request.
Where can I find a NIS2 checklist and how do I start?
The checklist follows the three duties of the Cyberbeveiligingswet. First determine the scope yourself; no letter is sent. Then register at mijn.ncsc.nl. Implement the ten measures of Article 21 and set up the reporting duty; an early warning within 24 hours, a notification within 72 hours and a final report within one month. Finally test with a penetration test whether the measures work. Pentrox delivers the report within 5 business days; a retest within 90 days is included.
How do you demonstrate NIS2 compliance with a penetration test?
The Cyberbeveiligingswet asks for evidence that your measures work, not only that they exist. A penetration test report is that evidence: which systems were tested, what was found, how severe it was and whether the remediation held at the retest. Keep the report and the retest results with your NIS2 file. That is how you demonstrate NIS2 compliance to the supervisor, to customers and to the board.
Related assessment categories
Infrastructure Security
Network infrastructure, Active Directory, and segmentation testing in depth.
Advanced Testing
Scenario-based assessments, red team exercises, mystery guest, and phishing simulations.
Pentest as a Service (PTaaS)
A continuous subscription covering recurring assessments across an agreed annual day allocation.