On this page
In scope for NIS2? Run the free scan at scan.sumrite.com to check your exposed systems, then build the testing programme your effectiveness reviews will rely on.
NIS2 (Directive (EU) 2022/2555) replaced the original NIS Directive and widened the net considerably. More sectors, more entities, tougher supervision and personal accountability for management. The question we hear most from European clients is simple: does it force us to run penetration tests? The honest answer is that it does not say so in those words, and that testing is still the sensible way to meet what it does say.
Who NIS2 covers
NIS2 applies to essential and important entities above the size thresholds (broadly, medium and large organisations), with some entities in scope whatever their size. The sectors include:
Sectors of high criticality
Energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management, public administration and space.
Other critical sectors
Postal and courier services, waste management, chemicals, food, manufacturing of certain products, digital providers such as online marketplaces and search engines, and research.
Transposition into national law was due by 17 October 2024, so the obligations now flow through each member state’s own implementing law. Check the transposed law in every country where you operate, because details and timelines vary.
What Article 21 actually requires
Article 21 is the heart of it. Entities must take “appropriate and proportionate technical, operational and organisational measures” to manage risks to their network and information systems. The article lists ten areas these measures must cover, including:
- risk analysis and information system security policies;
- incident handling;
- business continuity and crisis management;
- supply chain security;
- security in acquisition, development and maintenance, including vulnerability handling and disclosure;
- policies and procedures to assess the effectiveness of the risk-management measures;
- basic cyber hygiene and training;
- cryptography;
- access control and asset management;
- multi-factor authentication.
The point relevant to testing is the sixth: you must be able to show your controls work, not just that they exist. You cannot assess effectiveness credibly without testing, and penetration testing is the method that tells you whether a control would actually stop an attacker.
Where testing is named
For certain digital-sector entities, such as DNS providers, cloud and data-centre providers, content delivery networks, managed service and managed security service providers, online marketplaces, search engines and social platforms, the Commission issued technical and methodological requirements in an implementing regulation. That regulation’s security-testing section expects entities to decide the need, scope, frequency and type of security tests from their risk assessment, and its recitals explicitly mention penetration tests and vulnerability scanning among the methods available. It stops short of a universal “you must pentest every year” rule, leaving the cadence to the risk assessment.
Read the method as 'prove it', not 'do a specific test'
NIS2 is outcome-based. It tells you to manage risk and prove your controls work, and leaves you to choose how. That freedom is not an excuse to skip testing; it is a duty to choose testing that genuinely demonstrates effectiveness, and to justify your choice.
The penalties make this worth getting right
NIS2 raised the stakes to GDPR-like levels:
| Entity type | Maximum administrative fine |
|---|---|
| Essential entities | At least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher |
| Important entities | At least EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher |
Beyond fines, national authorities can suspend certifications or authorisations and hold senior management personally accountable for failures to comply. “We had policies” is a weaker position than “we had policies and tested that they worked”.
A testing programme that satisfies NIS2
- Identify your essential services. List the services NIS2 cares about and the systems that support them.
- Run a risk assessment. Let it set the scope, frequency and type of testing, because the rules point back to it.
- Test the supporting systems at least yearly. External and internal network testing, web application and API testing, and cloud assessments of what underpins the service.
- Add change-driven tests. Test major releases, migrations and new third-party integrations before they go live.
- Close the loop. Track findings to closure, retest, and feed the results into your effectiveness review so the paper trail shows the control cycle working.
- Consider red teaming for maturity. For larger entities, red team operations test detection and response, which is exactly the “effectiveness” NIS2 asks you to assess.
If you also fall under DORA as a financial entity, the two overlap. Our guide to DORA TLPT vs penetration testing lines up the requirements so you can plan one programme, not two.
How Summit helps
Summit runs the testing that NIS2 effectiveness reviews depend on: network, web application, cloud and, for mature programmes, red team engagements, each with findings tracked to closure and a retest. We map the work to your essential services and give you evidence an auditor or national authority can follow. Our DORA and NIS2 compliance page covers the wider duties. The scanner-level first look is free at scan.sumrite.com.
Build a NIS2 testing plan you can defend
Tell us your essential services and the systems behind them. We will design annual testing and effectiveness reviews around them. Get a quote or run the free scan first.
Related reading: DORA TLPT vs penetration testing · Which compliance frameworks require penetration testing? · Cloud penetration testing on AWS, Azure and GCP
Frequently asked questions
Does NIS2 require penetration testing?
Not by name. The directive requires entities to take appropriate risk-management measures and to have policies to assess their effectiveness (Article 21). Penetration testing is one of the methods named in the technical implementing rules as a way to do that, so for most entities it is the practical route to compliance rather than an explicit mandate.
Who is covered by NIS2?
Essential and important entities in sectors such as energy, transport, banking, health, drinking and waste water, digital infrastructure, public administration, space, postal services, waste management, chemicals, food and manufacturing. Size matters too: generally medium and large organisations, with some entities in scope regardless of size.
What is the difference between essential and important entities?
It mainly affects supervision and penalties. Essential entities face proactive supervision and higher maximum fines; important entities face mainly reactive supervision. Both must meet the same Article 21 risk-management duties.
What are the penalties under NIS2?
For essential entities, fines up to at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities, up to at least EUR 7 million or 1.4% of worldwide annual turnover. Management can also be held accountable.
How often should a NIS2 entity test?
The directive sets no fixed interval. A defensible baseline is at least annual testing of the systems supporting your essential services, plus testing after major changes and when the threat picture shifts, with the cadence justified by your risk assessment.
How do I start?
Run Summit's free scan at scan.sumrite.com for the obvious exposures, map the systems behind your essential services, and plan annual penetration testing and effectiveness reviews around them.
