Assurance goals
NIS2 readiness
How security testing can support cybersecurity risk-management measures under the NIS2 Directive (EU) 2022/2555.
The NIS2 Directive asks essential and important entities to take appropriate and proportionate cybersecurity risk-management measures. These include vulnerability handling and policies to assess whether those measures are effective. Security testing can produce evidence for both.
How testing can support this goal
- Evidence for vulnerability handling in the acquisition, development and maintenance of systems (Article 21(2)(e)).
- Evidence on whether security measures work in practice, relevant to the effectiveness assessment (Article 21(2)(f)).
- Prioritised actions that support management decisions and an improvement plan.
- Technical input for supplier and product security discussions where they are in scope.
What testing does not do
- One test does not establish NIS2 compliance, and it does not replace a regulatory decision or supervision.
- Obligations depend on the entity category and on the national law that implements the Directive. Check the applicable national law.
- A test covers the scope that was tested. It does not cover the whole organisation.