NIS2 Penetration Testing Checklist: What your auditor really wants to see in 2026
Discover which penetration testing and security testing auditors really expect for NIS2 compliance across Belgium, the Netherlands and the EU. Includes a practical checklist, audit pitfalls and concrete steps to become provably compliant and audit-ready.
If your organization falls under NIS2, one question is critical today: Can we prove that our security actually works?
In practice, auditors expect you to demonstrate that you:
- Test external attack scenarios (as a real attacker would)
- Test internal risks (what someone can do once inside)
- Test human risk (phishing, social engineering)
- Have proof that vulnerabilities were fixed
- Perform and document retesting
This is the current reality of NIS2 audits across Europe.
TL;DR
- NIS2 requires provable security testing, not just policies
- Most companies fail on remediation proof and follow-up
- Pentesting without retesting and remediation evidence is usually audit-insufficient
Why This Is Critical Today
NIS2 has been active since October 2024. Many organizations are now in audit cycles or preparing for them.
Companies are no longer searching for theory. They want to know:
- What do we need to do in practice
- What must we show to an auditor
- What is actually checked during audits
In real audits, companies usually fail on evidence and follow-up, not on performing the tests themselves.
What NIS2 Means in Practice for Security Testing
| NIS2 Domain | Security Test | Frequency | Practical Reality |
|---|---|---|---|
| External attack surface | External pentest (authenticated where possible) | Yearly | More often for high exposure environments |
| Internal risks | Internal pentest | Yearly | Lateral movement and privilege escalation testing |
| Human factor | Social engineering / phishing | 1-2x per year | Awareness training alone is not enough |
| Audit evidence | Reporting + remediation tracking | Continuous | Retest proof is expected |
Pre-Audit Checklist (What You Must Be Able to Show)
✅ Full asset inventory ✅ Risk analysis linked to business impact ✅ Latest pentest reports ✅ Remediation evidence ✅ Retest results ✅ Awareness evidence ✅ Logging and monitoring evidence
What Auditors Expect From Your Pentest
An NIS2-relevant pentest must demonstrate:
- Real exploitable vulnerabilities
- Realistic attack paths
- Business impact
- Prioritized remediation actions
- Mapping to frameworks such as OWASP or NIST
Where Audits Usually Fail
Most common problems:
❌ Pentest report without follow-up ❌ No proof vulnerabilities were fixed ❌ No retest evidence ❌ No documented risk acceptance
Auditors typically look for:
✔ Remediation tickets and tracking ✔ Closure evidence ✔ Retest results ✔ Management approval
The Biggest Misconception About NIS2
Many organizations believe:
“We do a pentest → so we are compliant.”
Reality is: Test → Fix → Verify → Document → Repeat
Frequently Asked Questions
How often should an NIS2 pentest be performed?
At least annually. More often for critical systems or high exposure environments.
Is vulnerability scanning sufficient for NIS2?
No. Scans show potential risk, while pentests validate realistic attack paths and impact. Audits typically expect more than scanning alone.
Can you be NIS2 compliant without pentesting?
In practice, this is difficult to defend. Security testing is needed to prove technical controls work and that risk is measurably reduced.
What does an auditor check first?
Evidence of follow-up: remediation tracking, closure proof, retest results and management approval, not just a report.
Practical 6-Step Security Testing Roadmap
- Define scope based on risk
- Perform external and internal pentesting
- Perform human risk testing
- Execute and track remediation
- Perform retesting
- Bundle audit evidence
What Companies in Belgium and the Netherlands Often Underestimate
- Human risk remains the #1 entry vector
- Identity and SaaS attacks are often not tested
- Reporting quality strongly influences audit outcome
When Continuous Testing Makes More Sense
Continuous testing (such as PTaaS) often becomes more relevant if you:
- Have frequent infrastructure or application changes
- Are cloud-first
- Operate under heavy compliance pressure
- Depend on many vendors or SaaS platforms
Conclusion
NIS2 is not about security tools. It is about proving that you control your risks. Organizations investing in realistic testing and evidence-based security processes pass audits much faster. Others typically run into problems once audits start.
Want to understand where you stand today against NIS2 audit reality? Request an NIS2 readiness assessment or audit gap analysis.