NIS2 guide

NIS2 Article 21: the ten measures in plain English

Article 21 is the core of NIS2. Every essential and important entity must take "appropriate and proportionate technical, operational and organisational measures" to manage the risks to the network and information systems it uses (Article 21(1)). Paragraph 2 lists ten measures that must be included as a minimum, points (a) to (j).

This guide explains each point in plain English and gives a checklist of what usually shows it is in place. Not sure whether NIS2 applies to you? Start with Does NIS2 apply to your business?

Last checked 3 November 2026 against the Directive's text on EUR-Lex. The quoted words are the Directive's. The checklists are our suggestions: the Directive sets the outcome, not the paperwork, and your national law may add detail. This is not legal advice.

How Article 21 works

Proportionate. The measures must fit the risks. They take into account the state of the art, relevant European and international standards, and the cost. When judging proportionality, "due account shall be taken of the degree of the entity's exposure to risks, the entity's size and the likelihood of occurrence of incidents and their severity" (Article 21(1)). A 60-person manufacturer's measures can be simpler than a bank's, as long as they fit its risks.
All hazards. The measures protect systems "and the physical environment of those systems" (Article 21(2)). Fire, flood, power cuts and theft count, not only attacks.
Management signs off. The management body must approve the measures, oversee how they are put in place, and can be held liable if the entity breaks Article 21 (Article 20(1)). Its members must also follow training (Article 20(2)).
Gaps get fixed. An entity that finds it does not meet a measure must take the corrective measures needed "without undue delay" (Article 21(4)).
Digital providers have a detailed rulebook. For DNS, top-level domain, cloud, data centre, content delivery network, managed service, managed security service, online marketplace, search engine, social network and trust service providers, Implementing Regulation (EU) 2024/2690 sets out the technical requirements for each point (Article 21(5)). If you are one of these, its Annex is your checklist and this page is an overview.

(a) Risk analysis and security policy

"policies on risk analysis and information system security"

Write down how you find and rank your security risks, and set an overall security policy that management approves.

An information security policy approved by management, with an owner and a review date.
A simple risk assessment method and a risk register, reviewed every year and after big changes.
An asset list good enough to show what you are protecting.

In our kit: 03 Information Security Policy, 04 Risk Management Procedure, Risk Register.

(b) Incident handling

"incident handling"

Know how you spot, assess, contain and recover from an incident, and who does what. This includes deciding quickly whether an incident is significant, because significant incidents must be reported within 24 hours (see NIS2 incident reporting).

An incident response plan with roles, a severity scale and contact details, including out of hours.
A log of incidents and of the decisions made while handling them.
A decision step for "is this significant, and who must we tell?"
System logs kept long enough to investigate what happened.

In our kit: 12 Incident Response Plan, 12c NIS2 Incident Notification Templates, 10 Logging and Monitoring Procedure, Incident Log.

(c) Business continuity

"business continuity, such as backup management and disaster recovery, and crisis management"

Keep your services running through an incident, or get them back quickly, and know who leads in a crisis.

Backups of critical systems and data, with at least one copy offline or that cannot be changed.
Restore tests on a schedule, with the results written down.
A recovery plan for your most important services, with target recovery times.
Crisis roles: who decides, who talks to customers and staff.

In our kit: 11 Backup and Business Continuity Policy.

(d) Supply chain security

"supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers"

Manage the security risk that comes from your suppliers, especially IT and cloud providers. You must take into account each direct supplier's specific weaknesses and the overall quality of its products and security practices, including how it develops software securely (Article 21(3)). This is the point that leads NIS2 organisations to send questionnaires to suppliers that are not in scope themselves.

A supplier register that marks which suppliers are critical.
Security checks before you sign with a critical supplier: a questionnaire or evidence.
Security clauses in contracts, such as incident notice, access rules, data return at exit and a right to audit.
A review of critical suppliers every year.

In our kit: 13 Supplier Security Policy (supplier tiers, eleven contract clauses and a twelve-question questionnaire), Supplier Register.

(e) Secure acquisition and maintenance

"security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure"

Build security into what you buy, build and look after: patching, secure settings, controlled changes, and a way for people to tell you about weaknesses they find.

Patch timescales by severity, and a record that you meet them.
A secure standard configuration for laptops, servers and cloud services.
Change control for important systems.
A published contact for vulnerability reports, and a process for handling them.

In our kit: 09 Patch, Vulnerability and Secure Configuration Procedure.

(f) Checking the measures work

"policies and procedures to assess the effectiveness of cybersecurity risk-management measures"

Check that the measures work in practice, not only that they are written down, and report the results to management.

An internal review against this list every year.
A few figures you track, such as MFA coverage, patch times and restore test results.
Minutes showing that management saw the results and agreed the actions.

In our kit: 15 Management Review Minutes Template, the Internal Audit Checklist, 10 Logging and Monitoring Procedure.

(g) Cyber hygiene and training

"basic cyber hygiene practices and cybersecurity training"

Everyday good practice for everyone. Recital 89 gives examples: zero-trust principles, software updates, device configuration, network segmentation, identity and access management and user awareness, plus staff training on threats such as phishing and social engineering.

Acceptable use rules that every member of staff has read and signed.
Security training when people join and every year after, with a record of who did it.
Training for the management body, which Article 20(2) requires.
A simple way for staff to report a suspicious email.

In our kit: 07 Acceptable Use and Cyber Hygiene Policy, 08 Awareness, Training and HR Security Plan, Training Log.

(h) Cryptography

"policies and procedures regarding the use of cryptography and, where appropriate, encryption"

Decide where you use encryption and how you manage the keys.

Full-disk encryption on laptops and phones.
Encryption in transit for your services and email.
Rules for keys and certificates: who holds them and how they are renewed.
A short list of approved algorithms and protocols.

In our kit: 14 Cryptography and Data Protection Policy.

(i) People, access and assets

"human resources security, access control policies and asset management"

Three related things: people are vetted and trained for their role, they have only the access they need, and you know what hardware, software and data you hold.

Joiner, mover and leaver steps, so access ends on someone's last day.
Least privilege, with separate accounts for administrator work.
Regular access reviews, more often for administrator rights.
An asset register of hardware, software, data and cloud services, each with an owner.

In our kit: 05 Asset Management Policy, 06 Access Control and Authentication Policy, 08 Awareness, Training and HR Security Plan, Asset Register, Access Review Log.

(j) MFA and secure communications

"the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate"

Use multi-factor authentication, use secure tools for calls and messages, and have a way to talk if your normal systems are down.

MFA on email, remote access, administrator accounts and cloud services.
Approved tools for calls, video and messaging, set up securely.
A fallback for an incident, such as a phone list that does not depend on your email or network.

In our kit: 06 Access Control and Authentication Policy, 14 Cryptography and Data Protection Policy.

Evidence and where to start

Authorities can ask an entity for its documented cybersecurity policies and for evidence that they are applied, such as the results of security audits (Article 32(2) for essential entities, Article 33(2) for important entities). Customers ask for much the same in their questionnaires. So for each point, keep the document and the record that shows it in use: the signed policy, the restore test result, the training log, the access review.

If you are starting from nothing, one workable order is:

Governance: name an owner and have management approve the security policy.
Inventory: list your assets and suppliers.
The key measures: MFA, backups with restore tests, patching, logging and training.
Incident readiness: the response plan, the reporting decision and pre-written notices.
Review: check what works, record it, and take it to management.

The 30-day plan in our NIS2 Small-Entity Compliance Kit works through the first four steps in this order. The kit has a document for each point above, with the Article 21(2) points it covers listed in each document's control table, and registers for the evidence.

Sources

Directive (EU) 2022/2555 (NIS2), EUR-Lex: Articles 20, 21, 32 and 33, recital 89.
Commission Implementing Regulation (EU) 2024/2690, EUR-Lex: technical requirements for digital infrastructure and digital service providers.