Service · pentest
NIS2 audit,
your measures put to the test.
Article 21(2) also requires you to assess how effective your measures are. An OSWE-certified pentester attacks your exposed systems, maps every finding to the ten measures of the article and comes back to check your fixes. Technical side only: writing your security policy is not part of it, and the scoping says so from the start.
€2,250 for 5 days · retest included · VAT not applicable- Tested
- 4 / 10
- the test checks it
- Informed
- 4 / 10
- the test feeds evidence into it
- Not tested
- 2 / 10
- to cover elsewhere
- (a)Risk analysis4 attack scenarios demonstrated, fed into the analysisInformed
- (b)Incident handlingProcedure and drills: outside the testNot tested
- (c)Continuity and crisis managementBCP and DRP: outside the testNot tested
- (d)Supply chain2 of a supplier's subdomains, not in the inventoryInformed
- (e)Development and vulnerabilitiesIDOR on /api/invoices/{id}, CVSS 8.1Tested
- (f)Effectiveness of measuresReport, remediation plan, retestTested
- (g)Cyber hygieneAdmin console exposed, default accountInformed
- (h)CryptographyTLS 1.0 still accepted on the extranetInformed
- (i)Access controlAccounting role promoted to admin via the APITested
- (j)MFA and communicationsNo second factor on the mobile APITested
A ticked compliance sheet does not tell you whether a measure holds.
Article 21(2) lists ten measures, and measure (f) asks for "policies and procedures to assess the effectiveness" of the other nine. The sheet answers "does the measure exist?". The auditor, the insurer and, after an incident, the regulator ask something else: does it hold when someone tries to get through?
- (j)
What the sheet says : Multi-factor authentication: deployed
What the test found : The mobile app API accepts a password on its own.
- (g)
What the sheet says : Default accounts: removed
What the test found : The admin console answers from the internet, with the vendor's shipped account.
- (h)
What the sheet says : Encryption in transit: compliant
What the test found : The extranet still accepts TLS 1.0.
The test does not replace the sheet. It adds what measure (f) is missing: dated, replayable evidence, then the retest that shows the fix.
What an SME shows online, before anyone tests it.
In October 2026, own2pwn measured from the outside the posture of SMEs linked to a website in their own name, across five sectors: telecom and digital, construction, manufacturing, transport, health. Nothing intrusive: public DNS records, the TLS handshake and the home page, what any visitor sees.
10,609 SMEs measured, 15.6% of the SMEs in the five sectors
(j) Email and communications
84.7%
do not enforce DMARC (neither quarantine nor reject)
Without an enforced DMARC policy, anyone can send email under the company's domain.
(e) Maintenance and vulnerabilities
22.3%
expose a readable end-of-life software version
A version that no longer gets patches, shown to anyone who asks.
(h) Cryptography
63.6%
do not enable HSTS
Without HSTS, nothing stops a browser from falling back to unencrypted HTTP.
(g) Cyber hygiene
56.5%
send none of the five HTTP security headers
No CSP, no framing protection, no nosniff, no Referrer-Policy, no Permissions-Policy.
Size matters for email: 87.0% of SMEs with 10 to 49 employees do not enforce DMARC, against 75.3% of those with 50 to 249. These signals can be read without attacking anything. A penetration test starts where they stop: it checks what an attacker does with them.
Passive measurement on 11 and 12 October 2026 of 10,609 SMEs linked to a website in their own name (15.6% of the SMEs in the frame), five sectors. The figures describe those SMEs only. No site is named. Full results and method of the study (in French).
The ten measures of article 21(2), one by one.
For each measure, what an auditor expects to read and what a technical test can establish. Four are tested directly, four are informed by the test, two are not tested. The report carries the same split, so that no measure passes for covered when it is not.
| Measure | Expected evidence | What the test establishes | Status |
|---|---|---|---|
| (a)Risk analysis and information system security | Methodology, mapping, risk scenarios | Demonstrated, dated attack scenarios to rate likelihood | Informed |
| (b)Incident handling | Procedure, incident log, notification deadlines | Nothing: a matter of organisation and drills | Not tested |
| (c)Business continuity and crisis management | BCP, DRP, restore tests | Nothing | Not tested |
| (d)Supply chain security | Supplier inventory, contract clauses | The surface exposed by third parties and forgotten assets | Informed |
| (e)Acquisition, development and vulnerabilities | Vulnerability management policy, development lifecycle | Flaws found, exploited and documented: the core of an application test | Tested |
| (f)Assessing the effectiveness of measures | Test reports, remediation plan, retest | The measure the test directly produces | Tested |
| (g)Cyber hygiene and training | Policy, awareness plan | Default accounts, exposed services, certificates | Informed |
| (h)Cryptography and encryption | Cryptography policy, configurations | TLS configuration, weak algorithms in white box | Informed |
| (i)Human resources security and access control | Entitlement matrix, access reviews | Application side: privilege escalation, horizontal access | Tested |
| (j)MFA and secured communications | MFA rollout, encrypted channels | MFA bypass, sessions, unprotected channels | Tested |
The measure-by-measure reasoning is laid out in the guide (in French) NIS2 audit: process, deliverables and pricing.
From scoping to retest, in four stages.
- 01
Scoping
Sector, size, exposed scope: first check that NIS2 applies to you, then set what will be tested, on which environment and in which windows. The audit agreement and written authorisation are signed before the first request.
You receiveWritten agreement and scope
- 02
Test
Mapping of what can be reached from the internet, then manual exploitation. Every flaw is confirmed by hand, scored with CVSS and captured at the moment it gives way.
You receiveTimestamped captures of every flaw
- 03
Report mapped to the measures
An executive summary for management, the technical detail for the teams, and every finding mapped to measures (a) to (j) of article 21(2). Walkthrough in a meeting.
You receiveReport, matrix, remediation plan
- 04
Retest of the fixes
Once your fixes are in place, every fixed flaw is replayed. The matrix is updated with the state after remediation.
You receiveDated retest report
What goes into your audit file.
Four documents, written to be read by someone who was not there during the test.
- Two-tier reportA summary management can read, then every flaw with its hand-replayed proof, its CVSS score and its fix.
- Mapping matrixEvery finding linked to the article 21(2) measures. The measures the test does not cover are written down as such.
- Prioritised remediation planThe fixes in the order to make them, with the estimated effort for each.
- Retest reportThe dated check of every fix. This is the effectiveness record measure (f) asks for.
No NIS2 certification or compliance attestation: none exists, and nobody can issue one. The file helps you demonstrate that your measures are effective.
NIS2 audit, technical side
ANONYMISED COMPANY
No critical flaw, but a chain rated high leads from a free trial account to administrator control of the instance. Fix expected before the next release.
Privilege escalation through mass assignment on the profile API
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PATCH /api/v1/users/me HTTP/1.1
Host: api.client-anonymise.example
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.[...]
Content-Type: application/json
Content-Length: 37
{"displayName":"test","role":"admin"}HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 51
{"id":"u_2841","displayName":"test","role":"admin"}Request replayed by hand, token truncated, identifiers replaced.
Anonymised mock-up: an example of the deliverable format, with fictional data. No engagement report is ever published, and the name of a client is never disclosed.
The technical side, and only that.
A NIS2 audit has two halves. This one produces technical evidence. The other is documentary: it gets written, it does not get tested.
In the audit
- Penetration test of exposed applications and APIs
- Mapping of the external surface and forgotten assets
- Matrix mapping findings to article 21(2)
- Remediation plan and retest of the fixes
Outside the audit
- Writing the information security policy
- Documentary risk analysis
- Keeping the compliance register
- Business continuity and crisis management plan
Price, duration, prerequisites.
Prices are written down before the first call. Scoping then sets the exact perimeter.
| 5 days | 10 days | |
|---|---|---|
| Price | €2,250 | €4,500 |
| Scope | One exposed web application and its APIs | Several applications or environments |
| Retest | 1 retest included | 2 retests included |
| Debrief | Walkthrough meeting | Walkthrough meeting, summary for management |
- Day rate
- €450 per day
- Reply to a request
- within 24 h
- Pentester
- OSWE-certified
- Method
- OWASP WSTG, PTES, CVSS v3.1
- Prerequisites
- Written authorisation from the system owner, agreed scope, test accounts per role, agreed window
- Environment
- Staging that mirrors production by default, production possible with non-destructive tests
Group, several entities or a recurring campaign: quoted, at the same day rate.
Your questions about the NIS2 audit.
Does this NIS2 audit cover my whole compliance?
No, and nobody should sell you that. This engagement covers the technical side: evidence that your security measures are effective, and an inventory of your exposed assets. The governance side (risk analysis, security policy, business continuity, crisis management, awareness) belongs to an organisational audit, which own2pwn does not perform. The delivered matrix states explicitly which article 21(2) measures remain to be handled elsewhere, and that is what makes it usable by your auditor.
How much does the technical side of a NIS2 audit cost?
The day rate is €450 net, VAT not applicable under article 293 B of the French tax code. A 5-day engagement comes to €2,250, a 10-day engagement to €4,500, retest included in both cases. Group or multi-entity scopes are quoted after scoping. These figures are published because the pages selling this audit rarely show them, and because a flat price announced before the scope is defined is a number, not an engagement.
Is a penetration test mandatory for NIS2 compliance?
The directive does not name penetration testing as such. Measure (f) of article 21(2) requires policies and procedures to assess the effectiveness of risk management measures. Testing is the most direct and most documentable way to satisfy that requirement, but it is not the only possible route. That said, a purely declarative compliance posture leaves that measure without evidence.
Which article 21(2) measures can a test actually check?
Four are tested directly: security in development and vulnerability handling (e), effectiveness assessment (f), application-side access control (i), and multi-factor authentication and secure communications (j). Four are informed by the test without being fully covered: risk analysis (a), which receives demonstrated attack scenarios, supply chain (d) through the exposed surface, cyber hygiene (g) through forgotten accounts and services, and cryptography (h) through configurations. Two are not tested: incident handling (b) and business continuity (c).
Am I in scope for NIS2?
Two conditions apply together: operating in a sector listed in annexes I or II of the directive, and meeting the size of a medium enterprise, meaning at least 50 employees or more than 10 million euros in turnover. The sector comes first, not the headcount. Some critical entities are in scope regardless of size. If you are unsure, the online NIS2 assessment gives a first answer, and scoping settles it before anything is invoiced.
Can the deliverables be shown to an auditor or a regulator?
They are written to be read by an auditor or a regulator: a timestamped two-tier report, proof of exploitation, CVSS scores, a matrix mapping findings to the article 21(2) measures, a prioritized remediation plan, and a retest report attesting to the fixes. They help you demonstrate the effectiveness of your measures. They are not a NIS2 certification or compliance attestation: none exists, and nobody can issue one.
Should we test in production or in staging?
Staging by default, provided it mirrors production. A staging environment that has drifted produces a report that does not describe your real exposure, so weak evidence. If only production is representative, the test runs there, with non-destructive tests, an agreed window and a stop procedure. This is settled during scoping.
Further reading on NIS2.
NIS2 audit: process, deliverables and pricing
The full guide, with the article 21(2) mapping table.
Read →NIS2 directive: who is in scope
Sectors, thresholds, penalties and the transposition timeline.
Read →NIS2 for SMEs and mid-caps
What the directive changes in practice for a mid-sized organisation.
Read →A NIS2 audit to scope?
Send your sector, your size and your exposed scope. Reply within 24 hours, with a scoping note and a quote.