NIS2 penetration testing: what Article 21 asks you to prove.

§01

NIS2 in the Netherlands, in one table.

§02

Does NIS2 require a penetration test?

Not in so many words. Article 21 lists the cybersecurity risk-management measures that essential and important entities must take, and none of its ten points names penetration testing.Note 7 Point (f) is the one that matters here: policies and procedures to assess the effectiveness of those measures.Note 8

That is a duty to check, not only to have. An access review, a patch policy or a secure development process is a measure. A test that tries to get past them is an assessment of whether they work. A penetration test is one of the most direct forms of that assessment, because it reports what an attacker could actually do, with evidence, rather than what a configuration says should happen.

The Dutch Cyberbeveiligingswet copies the same duty into its article 21(3)(f).Note 9 Neither text prescribes a method, so the choice of assessment is yours, as long as it answers the question the law asks: do the measures work?

§03

Who does the Cyberbeveiligingswet cover?

The Cbw has applied since 15 August 2026.Note 10 It covers 18 sectors: 11 in its first annex, such as energy, transport, banking, health care, digital infrastructure and business-to-business ICT service management, and 7 in its second, such as postal and courier services, manufacturing, digital providers and research.Note 11

Being in a sector is not enough on its own. The law applies from medium-sized enterprises upwards, plus some entity types at any size, such as trust service providers and providers of public electronic communications networks.Note 12 The NCSC puts the number of Dutch organisations with duties under the Cbw at more than 8,000.Note 13

Banks and insurers follow DORA instead for ICT risk and testing. The Digital Operational Resilience Act has applied since 17 January 2025, and for financial entities NIS2 would cover it is the sector-specific act that takes precedence.Note 14 Article 25 lists penetration tests among the tests a financial entity runs, and that is the work we do, the chatbot and its AI layer included; it can sit next to a TLPT provider's work.Note 15 Threat-led penetration testing (TLPT) under Article 26 is a separate regime, every three years for the entities their supervisor names, and we are not a TLPT provider yet: Article 27 asks those testers for the highest suitability and reputability, proven expertise in threat intelligence and red teaming, certification or a formal code of conduct, an independent audit of how they manage the test's risks, and indemnity insurance, and a firm as young as ours cannot show all of that.Note 16

Whether your organisation is essential, important or out of scope is a legal question. We test; classification is for your counsel.

§04

Why NIS2 reaches suppliers that are not in scope.

Article 21 also asks for supply chain security, including the security of the relationship between an entity and its direct suppliers and service providers.Note 17 Entities must take into account the vulnerabilities specific to each direct supplier and the overall quality of its products and cybersecurity practices, including its secure development procedures.Note 18

So if you sell software to a hospital, a bank or a logistics company, their duty tends to arrive as your security questionnaire. That is an inference, not a line in the law, but it is the practical effect: the customers in scope have to weigh you, and a recent pentest report with its scope, dates, findings and retest status is the most direct answer you can attach.

§05

What a pentest report should show for NIS2.

Because the law asks about effectiveness, the useful report ties each finding to a measure. We write ours so that every part answers a question an auditor or a customer's security team will ask.

Scope and dates

Which systems, which accounts, which window. An assessment is only as wide as its scope, so the report says what was out of it.

Method

The standard each test maps to: the OWASP Web Security Testing Guide and the OWASP API Security Top 10 for the stack, the OWASP Top 10 for LLM Applications and MITRE ATLAS for AI features.

Findings

What an attacker could do, with evidence and a severity in CVSS v4.0, so the risk can be weighed against the measure that should have stopped it.Note 19

Retest status

Which findings were fixed and confirmed fixed, with dates. This is the part that shows a measure works now.

Attestation letter

One page with scope, dates and outcome, so you can answer a customer without sharing the findings.

Management bodies must approve these measures, oversee them and can be held liable when they fall short.Note 20 A report written for engineers, with a summary its board can read, serves both readers.