Is the effectiveness of security measures periodically assessed?

Testing is part of the measure itself, not a separate box

Yes, in most cases — but not as a standalone question, because Article 21(2) NIS2 formulates it as a characteristic of policy and procedures, not as a separate testing requirement. At point (a), the policy for risk analysis and the security of information systems, and at point (b), incident handling, periodic evaluation is part of what 'adequate' policy normally entails. Anyone who can demonstrate that measures are regularly reviewed — after an incident, after a pentest, after an audit finding — meets what the client actually wants to see with this question: a functioning management system, not a snapshot from a single policy document.

If the undertaking ISO 27001-certified is, this is usually the easiest piece of evidence: the standard itself requires internal audits and a management review, and those documents directly show that testing takes place. Without certification, the same can be substantiated with a pentest report, a record of an internal evaluation, or minutes in which security measures have been discussed and adjusted. If all that evidence is missing, then 'no' or 'in development' is a more honest answer than a yes without supporting documentation — especially because this question is often asked together with the one on policy for risk analysis, and inconsistency between the two answers will be noticed by a client who reads both.

Where this appears in the directive: Article 21(2)

Article 21(2) NIS2 lists ten categories of measures that must be 'appropriate and proportionate', and the recitals of the directive link proportionality to an ongoing process of risk assessment — not to a one-time implementation. An explicit separate obligation to 'periodic testing of effectiveness' as a separate article does not appear; it follows from the combination of point (a) risk analysis policy and point (b) incident handling, where lessons from incidents and periodic risk assessment logically lead to revision of measures. For the precise wording, the authentic directive is the source to fall back on.