---
title: "Test security with permission"
description: "Test security with permission, family Build, NIS2 Art. 21(2)(f)"
url: https://www.alt-f1.be/en/table/pt/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Test security with permission

Short label: TEST

Family: Build · NIS2 Art. 21(2)(f)
<a id="meaning"></a>

## Meaning

An authorised security test examines agreed systems and reports weaknesses, their impact and recommended fixes.

<a id="why"></a>

## Why it matters

A test provides evidence about the systems and conditions actually examined.

<a id="actions"></a>

## What you can do

Agree written scope and permission, protect real user data and plan remediation and retesting.

## Services that can help

ALT-F1 can help arrange independent testing. Web App Shield can mitigate some findings; Custom Software supports remediation. Filtering a request is not the same as fixing the underlying defect.

- [Web App Shield](https://www.alt-f1.be/en/web-shield.md)
- [Custom Software](https://www.alt-f1.be/en/custom-software.md)

## Official reference — NIS2 Art. 21(2)(f)

> 2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
>
> — Directive (EU) 2022/2555 (NIS2), Art. 21(2)

> (f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
>
> — Directive (EU) 2022/2555 (NIS2), Art. 21(2)(f)

**What this reference concerns:** You must check that your measures actually work — tests, audits, exercises — not only that they exist on paper.

[Read the article on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555#art_21) · Official text, quoted from the Official Journal of the EU