CER pentest: testing and demonstrating physical resilience

The Directive obliges operators of critical entities to test and document their physical resilience. We deliver the test and the audit report.

  • Directive (EU) 2022/2557
  • KRITIS-Dachgesetz, in force since 17 Mar 2026
  • Audit report for auditors and authorities

The four goals of Article 13 and what a test proves of them

Article 13 requires appropriate and proportionate measures along four goals. A physical penetration test is the audit instrument for the most important of them.

1

Preventing incidents

Measures that stop an incident from happening in the first place.

We actually attempt unauthorised access. Whatever we manage, prevention did not stop.

Test proves this directly
2

Ensuring physical protection

Access control, perimeter, securing the critical areas.

Fences, locking systems, badge logic and the route to the control room are each tested for effectiveness.

Test proves this directly
3

Responding to incidents

Detect, report, intervene. Initial notification under Art. 15 within 24 hours.

We log with timestamps whether and when someone notices the intruder and reports it.

Test measures detection
4

Recovering from the incident

Restore operations, eliminate root causes, detailed report within one month.

Not the subject of a pentest. Our findings go into your planning of measures as an input.

outside our scope

Deadlines and liability

Deadline

The KRITIS-Dachgesetz has applied since 17 March 2026. Registration via the BBK/BSI portal begins with the ordinance defining critical facilities; three months remain after that.

Sanction

Fines of up to €1m under section 24 KRITIS-Dachgesetz, orders from the authorities up to temporary operational restrictions, public disclosure of violations.

Liability

Section 20 KRITIS-Dachgesetz puts management on the hook. If it breaches this duty, it is liable to its own entity. The duty cannot be handed down.

What we deliver and what we don't

We carry out the test and document it as technical evidence for auditors and supervisory authorities. Whether you count as critical is set by the ordinance; registration is something you do yourselves. We do not offer legal advice or certifications.

What Article 13 requires in detail

  • Physical access controls

    Only authorised persons in critical areas. The test shows whether the rule holds in day-to-day operations or only exists on paper.

  • Perimeter security

    Fences, cameras, lighting and barriers should stop a determined attacker, not merely deter one.

  • Protection against insider threats

    Not every threat comes from outside. Social engineering and insider scenarios show how far someone gets from the inside.

  • Employee security awareness

    We test whether tailgating, pretexts and manipulation attempts are recognised, or whether someone holds the door open.

  • Incident detection and response

    How quickly is a physical intruder noticed, and how quickly is it reported?

  • Protection of critical resources

    Servers, control systems and control rooms need the highest protection. That is what we test specifically.

  • Personnel and supply chain

    Article 13 also requires background checks for security-relevant personnel and contractually passing the resilience obligations on to service providers.

Who the Directive applies to

Eleven sectors in the Directive's annex. The transport sector covers air, rail, road, water and public transit and is split here into two fields by mode of transport.

  • Energy
  • Transport: air & rail
  • Transport: road, water & public transit
  • Banking
  • Financial market infrastructure
  • Health
  • Drinking water
  • Waste water
  • Digital infrastructure
  • Public administration
  • Space
  • Food: production, processing & distribution

An operator is critical if it provides an essential service in one of these sectors and an incident would significantly disrupt that service. In Germany, an ordinance under the KRITIS-Dachgesetz sets the thresholds.

The process in five steps

  1. 1Scoping and target definition
  2. 2Reconnaissance
  3. 3Physical penetration test
  4. 4Documentation and assessment
  5. 5Final report

The final report contains every test action with a timestamp, each finding rated by severity and exploitability, the mapping to the Article 13 requirements catalogue, a prioritised remediation plan and a management summary for management, supervisory board and authorities.

Frequently asked questions

Does CER prescribe a penetration test?

No. The Directive names no testing method, but it does require operators to test, assess and document their physical measures. The physical penetration test delivers real insights for this instead of a risk model on paper.

Can CER and NIS2 be tested together?

Yes. A combined assessment tests physical and digital attack paths in one run. The two sets of evidence stay separate, though: CER (Directive 2022/2557) and NIS2 (Directive 2022/2555) come from the same EU package, but CER evidence does not replace NIS2 evidence, or vice versa.

How quickly must incidents be reported?

Article 15 requires an initial notification without undue delay, no later than 24 hours after the incident became known, where operationally feasible. A detailed report follows no later than one month after that.

Ready for your CER audit evidence?

A 30-minute initial consultation, free of charge. We talk through your facilities and clarify the scope; after that you receive a no-obligation offer.

Book a consultation Send an enquiry
hello@access-granted.de
+49 9281 5918506
Service: access-granted.de/en/pentest/cer

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: September 18, 2026