NIS2 Article 21: the 10 cybersecurity risk-management measures, explained

Article 21 of NIS2 requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems. The measures must follow an all-hazards approach and include, as a minimum, the ten measures listed in Article 21(2). NIS2 does not prescribe tools. How far you go depends on your exposure, size and the likely severity of incidents.

This guide covers what Article 21 requires, the ten measures one by one, what proportionate means, the supply chain paragraph, corrective action, the detailed implementing rules, who is responsible, and a checklist.

Article 21(2) measure	In one line	Typical evidence
(a) Risk analysis and information system security policies	Know your risks and write down how you handle them	Risk register, approved security policy
(b) Incident handling	Detect, respond to and learn from incidents	Incident procedure, incident log, exercise record
(c) Business continuity and crisis management	Keep critical services running and recover	Backup and restore tests, continuity and crisis plans
(d) Supply chain security	Manage the risk from direct suppliers and service providers	Supplier register, contract clauses, assessments
(e) Security in acquisition, development and maintenance	Build and buy securely, handle vulnerabilities	Secure development rules, patch records, disclosure policy
(f) Assessing effectiveness	Check that the measures work	Internal audit, test results, metrics
(g) Cyber hygiene and training	Basic practices and training for all staff	Hygiene baseline, training records
(h) Cryptography and encryption	Rules for using cryptography	Cryptography policy, key management
(i) HR security, access control, asset management	Right people, right access, known assets	Joiner-mover-leaver records, access reviews, asset inventory
(j) MFA and secured communications	Strong authentication and secure channels, where appropriate	MFA coverage, secure and emergency communication means

What does Article 21 require?

Two paragraphs set the frame. Article 21(1) requires measures that ensure a level of security “appropriate to the risks posed”, taking into account the state of the art, relevant European and international standards where applicable, and the cost of implementation. The measures must also prevent or minimise the impact of incidents on the recipients of your services and on other services.

Article 21(2) says the measures are “based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents”. A flooded server room or a power failure is in scope, not only an attacker.

The ten measures below are “at least” what you must include. They are headings, not a control catalogue. That is deliberate: the directive sets outcomes and leaves the method to you, your national law and, for some sectors, implementing rules.

What are the 10 measures of Article 21(2)?

Each heading below is the measure as worded in Article 21(2), followed by what it usually means in practice. The practice notes are guidance, not additional legal requirements.

(a) Policies on risk analysis and information system security

You need a documented way of identifying and assessing risks, and a security policy approved by management. In practice this is a risk register tied to the services in scope, with owners and treatment decisions, reviewed at planned intervals.

(b) Incident handling

You need to detect incidents, respond to them and learn from them. This measure is where Article 23 reporting becomes possible: without a working incident process, you cannot send an early warning within 24 hours. See the NIS2 incident reporting timeline.

(c) Business continuity, such as backup management and disaster recovery, and crisis management

You need to keep critical services running or restore them. The evidence that counts is a restore that was actually tested, not a backup that exists.

(d) Supply chain security

This covers “security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. Article 21(3) adds what you must take into account, as explained below and in NIS2 supply chain security.

(e) Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure

Security requirements when you buy or build, patching and vulnerability management while you run, and a way for others to report vulnerabilities to you.

(f) Policies and procedures to assess the effectiveness of cybersecurity risk-management measures

You must check that the other nine work. Internal audits, technical tests and a small set of metrics, such as patch times or MFA coverage, reviewed by management.

(g) Basic cyber hygiene practices and cybersecurity training

The directive’s recitals give examples of hygiene: zero-trust principles, software updates, device configuration, network segmentation, identity and access management and user awareness. Training covers all staff, and Article 20 separately requires training for members of the management body.

(h) Policies and procedures regarding the use of cryptography and, where appropriate, encryption

Which data is encrypted, with what, and how keys are managed. “Where appropriate” applies to encryption, not to having a cryptography policy.

(i) Human resources security, access control policies and asset management

Security in hiring, role changes and departures, access that matches roles and is reviewed, and an inventory of the assets you protect. An asset you do not know about cannot be patched.

(j) The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate

MFA “where appropriate”, secure internal communications, and a way to communicate during an incident when your normal channels may be compromised.

What does “proportionate” mean?

Article 21(1) names four factors: the entity’s degree of exposure to risks, its size, the likelihood of incidents, and their severity, including their societal and economic impact. A 60-person manufacturer and a cloud provider serving thousands of customers both implement all ten measures, but to very different depths.

Proportionality is not a way out of a measure. It decides how far you go, not whether you do it. The authority will expect you to explain your choices with your risk analysis.

What does Article 21(3) add on supply chain?

When deciding which supply chain measures are appropriate, you must take into account the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, including their secure development procedures, and the results of EU coordinated risk assessments of critical supply chains under Article 22. Asking every supplier the same questionnaire does not meet that on its own.

What if you find a gap?

Article 21(4) requires an entity that finds it does not comply with the measures to take “without undue delay, all necessary, appropriate and proportionate corrective measures”. A gap on your own register is not an infringement by itself. A gap you know about and leave open is harder to defend.

Are there more detailed technical requirements?

For some entities, yes. Article 21(5) required the Commission to adopt implementing acts for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers. That act is Implementing Regulation (EU) 2024/2690.

Its annex has 13 sections: security policy, risk management policy, incident handling, business continuity and crisis management, supply chain security, acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, human resources security, access control, asset management, and environmental and physical security. If you are not one of those providers, it is still the most detailed official reading of Article 21 available, and a useful benchmark.

National laws can add detail for other sectors. Check yours before you design controls.

Who is responsible for Article 21?

The management body. Article 20 requires it to approve the risk-management measures and oversee their implementation, and it can be held liable for the entity’s infringements of Article 21. Its members must follow training. For infringements of Article 21, national law must allow maximum fines of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher (Article 34).

How do you implement Article 21?

Start from the services in scope, not from the ten headings. Then:

1. Draw the scope: which services, systems and sites the measures cover.
2. Run a risk analysis on that scope, measure (a).
3. Get incident handling and reporting working, measure (b) and Article 23, because the clock applies from the first day.
4. Close the obvious hygiene gaps: MFA on administrative and remote access, patching, backups you have restored.
5. Build the supplier register and fix critical contracts, measure (d).
6. Set up effectiveness checks, measure (f), and report them to management.

If you already run ISO 27001, most of this exists. ISO 27001 vs NIS2 shows which measures an ISMS covers fully and where it falls short.

Where Article 21 programmes go wrong

Most fail on evidence, not on policy. The ten measures are easy to document and hard to prove. An authority can ask for “evidence of implementation of cybersecurity policies” (Articles 32 and 33): proof that MFA is on for every administrative account today, that critical patches went in within your own deadline, that the restore worked.

That evidence lives in your identity provider, your endpoint tools, your cloud accounts and your ticketing system. A certificate does not settle it either, because there is no NIS2 certificate. Collected by hand once a year, the evidence is out of date on arrival. Collected continuously from the systems, with a person reviewing the exceptions, it answers the question the authority actually asks. That is how the CloudSoul platform works. If you want to know where you stand first, a security audit against Article 21 is the fastest way to find out, and the wider programme is on the NIS2 compliance page.

NIS2 Article 21 checklist

• Define the services, systems and sites in scope.
• Keep a risk register with owners and treatment decisions, measure (a).
• Test incident handling against the 24-hour and 72-hour reporting deadlines.
• Restore from backup at least once and record the result.
• Maintain a register of direct suppliers with security clauses for the critical ones.
• Turn on MFA for administrative and remote access, and measure coverage.
• Review the effectiveness of measures at planned intervals and report to management.
• Record management body approval of the measures and its members’ training.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 22, 23, 32, 33 and 34 and recital 89, EUR-Lex.
• Commission Implementing Regulation (EU) 2024/2690, Annex, EUR-Lex.

Frequently asked questions