NIS2 Directive and DORA
NIS2 and DORA are each a law supervised by national competent authorities (NIS2) and financial supervisors (DORA).
VulnVerify provides the security testing and evidence your auditor asks for; the SOC 2 report, ISO 27001 certificate or PCI DSS assessment itself is issued by your CPA firm, certification body or assessor.
Who issues it and what you end up with
- Issued by
- EU law supervised by national competent authorities (NIS2) and financial supervisors (DORA). No certificate; TLPT under DORA is overseen by competent authorities using the TIBER-EU framework.
- Summary
- NIS2 Art. 21(2) requires vulnerability handling and disclosure (e) and policies to assess the effectiveness of security measures (f), without fixed frequencies. DORA requires a digital operational resilience testing programme (Art. 24), tests by independent parties (Art. 24(4)), at least yearly testing of ICT systems supporting critical or important functions (Art. 24(6)), a list of test types that includes vulnerability assessments and scans and penetration testing (Art. 25(1)), and — for designated significant entities only — threat-led penetration testing at least every three years on live production systems (Art. 26–27).
- Version
- NIS2: Directive (EU) 2022/2555 (transposed into national law; Implementing Regulation (EU) 2024/2690 details measures for certain digital-sector entities). DORA: Regulation (EU) 2022/2554, applicable since 17 Jan 2025.
Where scanning and penetration testing appear
Each control the page maps, with what it asks and whether a scan or a penetration test is required by it, supports it or is not named in it.
| Control | What it asks | Scan | Pentest | Note |
|---|---|---|---|---|
| NIS2 Art. 21(2)(e)Security in acquisition, development and maintenance, including vulnerability handling and disclosure | Essential and important entities take measures covering security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure. | Supports | Supports | Primary for scanning |
| NIS2 Art. 21(2)(f)Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Entities implement policies and procedures to assess the effectiveness of their cybersecurity risk-management measures. | Supports | Supports | Primary for penetration testing |
| NIS2 Art. 21(2)(a)Policies on risk analysis and information system security | Policies on risk analysis and information system security. | Supports | Supports | Secondary |
| DORA Art. 24(1)–(3)Digital operational resilience testing programme | Financial entities other than microenterprises establish, maintain and review a sound and comprehensive digital operational resilience testing programme as part of the ICT risk-management framework, following a risk-based approach. | Supports | Supports | |
| DORA Art. 24(4)Independent testers | Tests are undertaken by independent parties, whether internal or external. | Supports | Supports | |
| DORA Art. 24(6)Yearly testing of critical or important functions | At least yearly, appropriate tests are conducted on all ICT systems and applications supporting critical or important functions. | Supports | Supports | Frequency set by regulation |
| DORA Art. 25(1)Testing of ICT tools and systems | The programme provides for appropriate tests such as vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing. | Supports | Supports | |
| DORA Art. 26–27Threat-led penetration testing (TLPT) | Designated financial entities (not microenterprises, identified by their competent authority) carry out TLPT at least every three years, covering several or all critical or important functions, on live production systems, with testers meeting Art. 27 requirements; where internal testers are used, external testers must be contracted every third test. | Not named | Not named | Out of scope |
Minimum frequencies
The minimums the text sets, or that it sets none, and how weekly scanning compares.
- Scans
- NIS2 and DORA set no scan frequency. VulnVerify scans weekly (every 7 days).
- Penetration tests
- DORA requires testing at least every 12 months under DORA Art. 24(6).
What VulnVerify provides and what you still need
Control by control: the evidence VulnVerify produces, and what still comes from you, your auditor or another provider.
What VulnVerify provides
- NIS2 Art. 21(2)(e) Weekly scanning, finding triage and remediation tracking as the vulnerability-handling process.
- NIS2 Art. 21(2)(f) Periodic penetration tests and scan trend reports as effectiveness assessments; exportable evidence for authority requests.
- NIS2 Art. 21(2)(a) Findings as risk-analysis inputs.
- DORA Art. 24(1)–(3) Scheduled scans and pentests as programme components; cadence evidence.
- DORA Art. 24(4) VulnVerify as an independent external tester; independence stated in the report.
- DORA Art. 24(6) Annual pentest reminder and yearly scan coverage of in-scope systems.
- DORA Art. 25(1) Vulnerability scans and penetration tests are two of the listed test types.
What you still need
Out of scope for VulnVerify: DORA Art. 26–27.
- NIS2 Art. 21(2)(e) Coordinated vulnerability disclosure policy, secure-development rules.
- DORA Art. 26–27 A TLPT provider meeting Art. 27 requirements.
Questions about NIS2 and DORA
What do NIS2 and DORA require?
NIS2 Article 21(2) requires vulnerability handling and disclosure and policies to assess the effectiveness of security measures, without fixed frequencies. DORA requires a testing programme with tests by independent parties and at least yearly testing of systems supporting critical or important functions; threat-led penetration testing every three years applies only to designated entities and is not something VulnVerify offers.
Does GDPR require penetration testing?
Not by name. Article 32(1)(d) requires a process for regularly testing, assessing and evaluating the effectiveness of security measures; penetration tests and scans are the usual way to run and evidence that process.
Can VulnVerify issue my SOC 2 report or ISO certificate?
No. Those come from a licensed CPA firm and an accredited certification body respectively. VulnVerify supplies the technical testing and evidence they review.
Sources
The texts this page reads from.
- Directive (EU) 2022/2555 (NIS2), Article 21(2); Commission Implementing Regulation (EU) 2024/2690
- Regulation (EU) 2022/2554 (DORA), Articles 3(17), 24, 25, 26 and 27
- ECB/SSM — TIBER-EU guide for DORA TLPT (November 2025)
Your first report is free
Verify your domain and the first scan report is free. For a penetration test, contact sales.