Penetration Testing for Municipalities, NIS2-compliant.
Citizen portals and internal municipal applications are both targets and obligations. Resync delivers a manual penetration test with a report that is directly usable for ENSIA, BIO assessment and with the regulator. For the full pentest offering, including scope categories and pricing model, see the overview page.
What the law actually requires.
NIS2 (Network and Information Security Directive 2) has been implemented in the Netherlands through the Cybersecurity Act. Municipalities fall under the heaviest regime as "essential entities". The law demands four things directly relevant to penetration testing:
- Appropriate technical measures, demonstrably in place, not just on paper
- Periodic assessment of the effectiveness of those measures
- Risk analysis based on current threat intelligence
- Executive liability — aldermen and municipal secretaries are personally liable for negligence
An independent penetration test is in practice the most robust way to demonstrably meet requirements 1 and 2. The Resync report is structured so it can be used directly in ENSIA self-evaluations, BIO assessments and in NIS2 incident reports to the National Cybersecurity Centre (NCSC).
Municipality size does not determine whether NIS2 applies — for municipalities, the obligation is independent of population count. A municipality of 12,000 inhabitants has the same obligation as the G4 cities.
What Resync tests in municipal environments.
Citizen portals & "My Municipality"
DigiD integrations, IDOR on BSN-based resources, record access and application flows.
Permit & subsidy systems
Environmental permits, subsidy applications, WMO forms — often with file uploads and sensitive metadata.
Internal employee applications
Case management systems, base registers (BRP, BAG, BRK), DSO connections and mid-office components.
Public websites
The municipal website itself, council information systems, email campaigns and forms — often primary attack paths.
External chain connections
Diginetwerk, Haal Centraal, environmental agency integrations and joint public arrangements.
Cloud & SaaS vendors
Configuration of vendor environments (Azure tenants, M365, specialist SaaS) and SSO connections.
Directly usable in ENSIA and with regulators.
The report is structured in three blocks, suitable for both the executive team and the CISO/IBO:
- Executive summary — 1 page, readable by an alderman or municipal secretary
- NIS2/BIO mapping — findings linked to BIO themes and NIS2 categories
- Technical detail — reproduction steps, screenshots, priority and remediation path for the development team
- Retest declaration — after patching, as formal proof of remediation
At a Dutch municipality, Resync delivered a NIS2-compliant report including retest evidence. The report was used in the ENSIA self-evaluation process and as evidence to the Rijksinspectie Digitale Infrastructuur (RDI), without additional follow-up questions.
Questions from municipalities.
Is a pentest mandatory under NIS2?
How do you handle data from civil registration systems?
Does a pentest fit in the ENSIA planning timeline?
Demonstrably NIS2-compliant, without the pain.
One conversation about scope, ENSIA context and planning. Fixed-price quote within one business day, free intake, retest included.
Book a free intake → Back to home