The NIS2 security measures: Article 21 explained

What Article 21 actually requires

Article 21(1) of Directive (EU) 2022/2555 requires “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems”. Those measures must take into account the state of the art, relevant European and international standards, and the cost of implementation.

Proportionality is not left to taste. The same paragraph fixes what it is assessed against: “the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact”. A small important entity and a large essential entity can land in very different places – but both must address all ten areas. The class you fall into changes supervision, not the control set, as covered in the scope guide.

Article 21(2) then says the measures “shall be based on an all-hazards approach” and “shall include at least the following”. Two phrases doing a lot of work: all-hazards means physical, environmental and human failure sit alongside cyber attack, and “at least” means the ten are a floor, not a scope boundary.

The ten measures, and what a supervisor looks for

The measures below are the ten points of Article 21(2), verbatim in substance. The third column is where compliance work actually lands: it draws on the Annex to Commission Implementing Regulation (EU) 2024/2690, a detailed set of requirements for specified digital entity types.

Article 21(2) measures and the evidence behind them

Article 21(2)	Measure	What a supervisor looks for
(a)	Policies on risk analysis and information system security	A policy on the security of network and information systems and a separate risk management policy, plus compliance monitoring and independent review – IR Annex 1, 2, 2.2, 2.3
(b)	Incident handling	A handling process with documented event assessment and classification criteria, and post-incident reviews that feed back into the controls – IR Annex 3, 3.4, 3.6
(c)	Business continuity, such as backup management and disaster recovery, and crisis management	Backup plans covering recovery times; assurance copies are complete and accurate including configuration and cloud data; copies held outside the system network and far enough away to survive a site disaster; access controls on the copies; evidence of restores – IR Annex 4, 4.2
(d)	Supply chain security, including relationships with direct suppliers and service providers	A directory of suppliers and service providers, and a per-supplier risk judgement rather than a returned questionnaire – IR Annex 5, 5.2; Article 21(3)
(e)	Security in acquisition, development and maintenance, including vulnerability handling and disclosure	Security testing, patch management, network segmentation and a working vulnerability handling and disclosure process – IR Annex 6, 6.5, 6.6, 6.8, 6.10
(f)	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	A documented testing policy setting need, scope, frequency and type; a documented methodology; results recorded with criticality; mitigating actions applied to critical findings – IR Annex 7, 6.5
(g)	Basic cyber hygiene practices and cybersecurity training	Workforce awareness and cyber hygiene, plus role-specific security training where required – IR Annex 8.1 and 8.2
(h)	Policies and procedures regarding the use of cryptography and, where appropriate, encryption	A cryptography policy saying what is protected, with what, and when – IR Annex 9
(i)	Human resources security, access control policies and asset management	Verification of background, a disciplinary process, control of privileged and system administration accounts, a removable media policy and an asset inventory – IR Annex 10, 10.2, 10.4, 11, 11.3, 12, 12.3, 12.4
(j)	Multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communications, where appropriate	Authentication strength matched to the classification of the asset being accessed – IR Annex 11.7

The Implementing Regulation, and who it binds

Commission Implementing Regulation (EU) 2024/2690 was adopted on 17 October 2024 and published the following day. It lays down the technical and methodological requirements of the Article 21(2) measures, and specifies when an incident counts as significant – but only for a defined list of entities: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, of online search engines and of social networking services platforms, and trust service providers.

If you are not on that list, the Regulation does not bind you. It can still be a useful reference, but it does not replace your sector rules, national requirements or risk assessment.

Its Annex expands the ten points into 13 numbered sections, each tagged with the Article 21(2) point it implements.

The 13 Annex sections and the measures they implement

Annex section	Title	Implements
1	Policy on the security of network and information systems	Art 21(2)(a)
2	Risk management policy	Art 21(2)(a)
3	Incident handling	Art 21(2)(b)
4	Business continuity and crisis management	Art 21(2)(c)
5	Supply chain security	Art 21(2)(d)
6	Security in network and information systems acquisition, development and maintenance	Art 21(2)(e)
7	Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Art 21(2)(f)
8	Basic cyber hygiene practices and security training	Art 21(2)(g)
9	Cryptography	Art 21(2)(h)
10	Human resources security	Art 21(2)(i)
11	Access control	Art 21(2)(i) and (j)
12	Asset management	Art 21(2)(i)
13	Environmental and physical security	Art 21(2)(c), (e) and (i)

The three that trip people up

Several measures are familiar from other security frameworks. The following areas deserve explicit owners and evidence rather than an assumption that existing controls cover them.

• (d) Supply chain. Article 21(3) requires a judgement about each direct supplier and service provider: the vulnerabilities specific to them, the overall quality of their products and cybersecurity practices “including their secure development procedures”, and the results of the Union-level coordinated security risk assessments under Article 22(1). A returned questionnaire is not that judgement. The Verizon 2026 DBIR found breaches with third-party involvement up 60% year on year, reaching 48% of all breaches, which is the clearest evidence of why this point exists.
• (f) Effectiveness. This is an obligation in its own right, not a review step bolted onto the others. A programme with controls but no assessment method may struggle to show how their effectiveness is checked.
• (i) and (j) Access control and authentication. Annex 11.7 ties authentication strength to the classification of the asset being accessed. That requires an asset inventory (Annex 12.4) and a classification scheme – so assign ownership for that foundation as well as the MFA rollout.

How to evidence Article 21(2)(f)

For the digital entity types covered by the Implementing Regulation, Annex section 7 requires a policy and procedures for assessing effectiveness: what to measure, which methods to use, when to measure and evaluate, and who is responsible. Security testing under Annex section 6.5 can supply part of that evidence. Its requirements include:

1. establish, based on the risk assessment, “the need, scope, frequency and type of security tests”;
2. carry out tests “according to a documented test methodology, covering the components identified as relevant for secure operation in a risk analysis”;
3. “document the type, scope, time and results of the tests, including assessment of criticality and mitigating actions for each finding”;
4. “apply mitigating actions in case of critical findings”;
5. review and update the testing policy at planned intervals.

These records show how security testing was planned and followed up. They do not by themselves assess every risk-management measure. Connect the findings to the wider assessment process in Annex section 7, and keep evidence of management review and corrective actions.

Two duties that get missed

The first is the per-supplier judgement in Article 21(3), above. The second is Article 21(4): an entity that finds it does not comply with Article 21 must take corrective measures “without undue delay”. That converts a self-identified gap into a live legal obligation with a clock on it, which is exactly why gap assessments should be dated, tracked and closed rather than filed.

A useful gap register records the responsible owner, planned action, target date and progress. An incomplete register does not prove that no action occurred, but it makes timely corrective work harder to demonstrate.

Where to start

Run a gap assessment against the ten measures, mapped to the 13 Annex sections so each finding lands on something a supervisor recognises. The readiness scorecard on the home page is a quick first pass over the same ten points. Prioritise by exposure, not by ease: ENISA’s 2025 Threat Landscape puts phishing at roughly 60% of observed intrusion cases and exploitation of vulnerabilities at 21.3%, which points at points (g), (j) and (e) before most of the rest.

Then close the loop with evidence. The Annex 6.5 artefacts above are the shortest route to a defensible answer on effectiveness, and the compliance checklist sets out the rest of the programme, including the Article 20 governance duties and the Article 23 reporting clock.