NIS2 Compliance: What Article 21 Actually Requires (Including Testing)

"Are we NIS2 compliant?" is usually the wrong first question, most teams asking it haven't yet confirmed whether NIS2 applies to them at all, or which of its ten risk-management measures actually touch what they're doing day to day. Here's what Article 21 actually requires, without the compliance-vendor gloss.

Who NIS2 applies to

NIS2, Directive (EU) 2022/2555, replaced the original 2016 NIS Directive and significantly widened its scope. It splits covered organizations into "essential" and "important" entities across sectors including energy, transport, banking, health, digital infrastructure, and, notably for a lot of mid-sized companies who don't think of themselves as critical infrastructure, digital providers, manufacturing, and postal/courier services. Member states set their own exact thresholds within the directive's framework, so the honest first step is confirming your specific classification with your national implementing legislation, not assuming either way.

The ten measures under Article 21

Article 21 requires "appropriate and proportionate technical, operational and organisational measures" across ten areas:

1. Risk analysis and information security policies
2. Incident handling
3. Business continuity and crisis management
4. Supply chain security
5. Security in the acquisition, development, and maintenance of network and information systems, including vulnerability handling and disclosure
6. Policies to assess the effectiveness of cybersecurity risk-management measures
7. Basic cyber hygiene and cybersecurity training
8. Cryptography and encryption policies
9. Human resources security, access control, and asset management
10. Multi-factor authentication and secured communications

Two of these, #5 and #6, are where penetration testing actually earns its place. NIS2 doesn't use the words "penetration test" anywhere in Article 21. What it requires instead is that you can demonstrate your systems are being actively tested for exploitable weaknesses, and that you have a real policy for assessing whether your controls work, not just that they exist on paper. A pentest is the most direct, most commonly accepted way to produce that evidence, which is why it's become a practical expectation even though it's not a named line item.

"Proportionate" is doing real work in this article

The directive is explicit that these measures must be proportionate to your actual risk exposure, organization size, and the likely severity of an incident, a 40-person managed service provider and a national energy operator are not held to an identical testing cadence or budget. This matters in practice: proportionality is your justification for scoping decisions (what gets tested, how often, how deep), not an excuse to under-invest relative to your actual exposure. Auditors and national authorities generally expect that reasoning to be documented, not just asserted.

Supply chain security (#4) reaches further than most teams expect

Article 21 explicitly calls out supply chain security as its own measure, and NIS2's broader text extends accountability to security-relevant aspects of relationships with direct suppliers and service providers, not just your own infrastructure. If a vendor or ICT service provider you depend on gets breached, that's relevant to your own NIS2 posture, not a separate problem. This is one of the more commonly underestimated parts of the directive.

What to do first

• Confirm your entity classification (essential, important, or out of scope) against your country's transposition of the directive, not the directive's text alone, implementation details vary by member state.
• Map your current controls against the ten measures honestly, and write down where the gaps are before an auditor or regulator does it for you.
• Prioritize #5 and #6 if testing evidence is your weakest area, this is usually the fastest gap to close with a properly scoped engagement.

Our penetration testing engagements are built to produce the kind of documented, repeatable evidence Article 21's "assess effectiveness" language is actually asking for, and our security consulting work covers the broader governance and supply-chain gaps that sit alongside it. If you're further along and specifically operate in the financial sector, see our related piece on DORA and threat-led penetration testing, a materially different, narrower testing regime that sits on top of NIS2-style obligations for that sector specifically. For Article 21(2)(d)'s supply-chain measure specifically, see our piece on third-party and supply chain risk.