Penetration Testing Roadmap for NIS2 Compliance in SMEs

The Network and Information Security Directive 2 (NIS2), adopted by the European Union, introduces significant updates to cybersecurity requirements for essential and important entities, including Small and Medium-sized Enterprises (SMEs) in critical sectors. While penetration testing (pentesting) is a common practice in various compliance frameworks such as ISO 27001, NIS2 mandates a more nuanced approach tailored to the Directive's emphasis on operational continuity, supply chain resilience, and sector-specific risk management. This paper proposes a comprehensive roadmap for SMEs to execute penetration tests aligned specifically with NIS2 requirements, distinguishing them from standard pentesting methodologies.