NIS2 penetration testing: what Article 21 asks for

Article 21 of Directive (EU) 2022/2555 requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems. Paragraph 2 lists ten measures as the minimum. Two of them concern testing:

Article 20 makes your management body approve these measures and oversee them, and it can be held liable when the entity breaks Article 21. Under Articles 32 and 33, the competent authority can order security audits and ask for evidence that your policies are in place, including audit results and the evidence behind them.

NIS2 is a directive, so the law that binds you is your Member State's transposition. Article 41 set 18 October 2024 as the date Member States had to apply it. In Germany, points (e) and (f) became § 30(2) no. 5 and 6 of the BSI Act.

For some digital providers (DNS and TLD registries, cloud, data centres, content delivery networks, managed and managed security services, online marketplaces, search engines, social networks and trust services), Implementing Regulation (EU) 2024/2690 spells the measures out. Point 6.5 of its annex asks for a security testing policy. You decide the need, scope, frequency and type of tests from your risk assessment and test to a documented method. You record the type, scope, time and results of each test, with a criticality rating and a mitigating action for each finding, and you act on critical findings. Point 7 covers (f): decide what you monitor and measure, how, when, and who evaluates the results. Recital 15 of the same regulation names penetration tests among the security tests these entities may run.

Point (e) follows the system through its life: you build it, change it, and handle the vulnerabilities each change brings. Rheono's continuous plans start an intensive pass after each release on the web app and API in your written scope, and watch quietly between releases, so a vulnerability a release introduced is more likely to be found close to that release. Recital 15 of the implementing regulation names this moment among others: entities may test after significant infrastructure or application upgrades or changes, as well as at set-up and after maintenance. Each finding can go to your tracker as a ticket, and a retest after the fix records that it was handled. Starter runs one deep hunt a month instead.

Point (f) asks you to check that your measures work. A pentest is a direct check: an attacker's attempt against the controls you put in place, with the result written down and dated. Where point 7 of the implementing regulation applies, you decide what to measure, how and when, and a pentest after each release is one such measurement, timed to each change.

The fields line up with what point 6.5 of the implementing regulation asks covered providers to document:

• Type and method: external, non-destructive testing, and the verification bar every finding cleared
• Scope: the hosts and APIs you authorized in writing, and the exclusions
• Time: the test window and a timestamped run history in your portal
• Results: each finding with a CVSS severity, a CWE, a working proof of concept and a remediation
• Follow-up: a dated retest for every finding you fixed, in the next signed report
• References: the NIS2 point or § 30 BSIG clause each finding bears on
• Signature: Advanced electronic signature (eIDAS, PAdES-B-T) + RFC 3161 timestamp

The sample report shows the format with made-up data, including the § 30 BSIG reference on a finding.

Financial entities under DORA, Regulation (EU) 2022/2554, can be required to run threat-led penetration testing (TLPT) under Article 26: an intelligence-led red-team test of critical live production systems, at least every three years, with the scope validated by the competent authority and testers who meet Article 27. Rheono does not offer TLPT. It covers regular penetration testing of web apps and APIs, one of the tests DORA Article 25 lists for a resilience testing programme, and evidence for NIS2 Article 21(2)(e) and (f).

The report is evidence for two of the ten measures. It does not show that you comply with NIS2, and these calls are yours or your authority's:

• whether you are an essential or an important entity, and which national law applies
• whether the scope covers the systems your services depend on
• how the results feed the policy and procedures that point (f) asks for
• what else Article 21 needs, from incident handling to supply chain security, which a pentest does not touch

cSquare GRC, our GRC partner, runs NIS2 programs. It maps the signed report to Article 21(2)(e) and (f), or to the national clause that transposes them, tracks each fix until the retest closes it, and gives your auditor a read-only workspace.

Rheono tests and signs. The pentest-to-audit page shows the full loop.