NIS2 penetration testing: what the ACN measures require.
In Italy, the baseline security measures set by the National Cybersecurity Agency (ACN) require essential entities to test their relevant systems with vulnerability assessments and/or penetration tests, periodically and before go-live, and to document the results. We plan, run and document those tests.
What the rule says
Italy transposed NIS2 with Legislative Decree 138/2024, whose article 24 requires vulnerability handling and procedures to assess whether security measures work. The ACN baseline measures, applicable from 15 January 2026, make this concrete: for essential entities, measure ID.RA-01 requires vulnerability identification activities that include at least a vulnerability assessment and/or a penetration test on the relevant systems.
These activities must run periodically and in any case before systems go into production, and each one must be documented in a report that describes the activities and their outcomes, the vulnerabilities found and their security impact. Important entities are not bound by this specific clause, but they still have to identify and manage vulnerabilities, and testing remains the most convincing evidence that they do.
NIS2 Testing Evidence for ACN measure ID.RA-01
- Identification of the relevant information and network systems
- Vulnerability assessment of the agreed perimeter
- Penetration testing of the most critical systems
- Testing before new systems go into production
- Reports with activities, outcomes and impact of each vulnerability
- Input to the vulnerability management plan (ID.RA-08)
Outcomes
- Documented evidence for ACN audits
- Vulnerabilities ranked by security impact
- A test calendar aligned with releases
- Remediation tracked over time
From relevant systems to audit evidence, five phases.
We follow the structure of the measure itself, so each report maps directly to what an inspector will ask to see.
Relevant systems
Starting from your list of relevant information and network systems (GV.OC-04), we agree the perimeter and the test calendar, including systems about to go live.
Vulnerability assessment
Authenticated and unauthenticated scans with manual verification cover the agreed perimeter and remove false positives.
Penetration testing
On the most critical systems, testers exploit and chain weaknesses to show their real impact, within agreed rules of engagement.
Report for ID.RA-01
Each report describes the activities performed and their outcomes, and every vulnerability with its security impact, as point 3 of the measure requires.
Vulnerability management
Findings feed the vulnerability management plan required by measure ID.RA-08, and a retest on request confirms the fixes.
Grounded in the primary sources.
References: article 24 of Legislative Decree 138/2024, the ACN determination on baseline security measures with its Annex 2 for essential entities (in Italian), and Directive (EU) 2022/2555. Tests follow OWASP, PTES and NIST SP 800-115, and severity is scored with CVSS.
BackBox AI keeps testing sustainable on a large NIS2 perimeter: it speeds up mapping and verification across many systems, while testers concentrate on the critical ones.
Frameworks and references
NIS2 testing, common questions.
Does NIS2 require penetration testing?
The directive asks for procedures to assess the effectiveness of security measures, without naming specific tests. In Italy, the ACN baseline measures are explicit for essential entities: activities that include at least a vulnerability assessment and/or a penetration test on the relevant systems, periodically and before go-live.
We are an important entity: does the requirement apply to us?
Not in this form: the vulnerability assessment and penetration test clause of measure ID.RA-01 appears in the annex for essential entities. Important entities must still identify, record and manage vulnerabilities, and regular testing is the most direct way to show that they do.
How often do the tests have to run?
The measure fixes no frequency: it asks for periodic activities, in any case before go-live, consistent with your vulnerability management plan. A yearly cycle plus tests before each relevant release is a common baseline; your risk assessment may call for more.
What must the test report contain?
According to the measure, at least a general description of the activities performed and their outcomes, and a description of the vulnerabilities found with their impact on security. Our reports add evidence, a CVSS score and remediation guidance for each finding.
Can the same provider run both the vulnerability assessment and the penetration test?
Yes, and it keeps the results consistent: the assessment covers the whole perimeter, the penetration test goes deep on the most critical systems, and both end up in reports with the same structure, aligned with the measure.