Test security with permission
Short label: TEST
Meaning
An authorised security test examines agreed systems and reports weaknesses, their impact and recommended fixes.
Why it matters
A test provides evidence about the systems and conditions actually examined.
What you can do
Agree written scope and permission, protect real user data and plan remediation and retesting.
Services that can help
ALT-F1 can help arrange independent testing. Web App Shield can mitigate some findings; Custom Software supports remediation. Filtering a request is not the same as fixing the underlying defect.
Official reference — NIS2 Art. 21(2)(f)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(f)
You must check that your measures actually work — tests, audits, exercises — not only that they exist on paper.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.