NIS 2 Article 21: the risk-management measures explained one by one
Article 21 of Directive (EU) 2022/2555 (NIS 2) requires essential and important entities to take "appropriate and proportionate technical, operational and organisational measures" to manage the risks to their network and information systems and to prevent or minimise the impact of incidents. Its paragraph 2 lists ten measures, from (a) risk analysis policies to (j) multi-factor authentication and secured communications, that those measures "shall include at least", on an all-hazards basis covering the systems and their physical environment. Paragraph 3 adds supplier-specific checks, paragraph 4 requires corrective measures without undue delay, and paragraph 5 provides for implementing acts for digital providers. Below, each measure in plain words, with the evidence that shows it exists.
Why Article 21 is the heart of NIS 2
Most of the directive's obligations point back to Article 21. Under Article 20, the management body approves the measures "taken by those entities in order to comply with Article 21" and oversees their implementation. Under Article 34(4) and (5), the fine ceilings Member States must provide apply to infringements of Article 21 or Article 23. And competent authorities can order an entity to ensure that its measures comply with Article 21 (Articles 32(4)(d) and 33(4)). The text is identical for essential and important entities; what differs is supervision, as set out in NIS 2: essential vs important entities.
Measures a to e: policies, incidents, continuity, supply chain, acquisition
(a) Policies on risk analysis and information system security
A written security policy approved by management, and a risk analysis that covers all hazards, not only cyber attacks: recital 79 cites theft, fire, flood, telecommunication or power failures and unauthorised physical access. Evidence: the signed policy, a dated risk register, the treatment plan and the minutes of its review.
(b) Incident handling
Detect, triage, escalate, respond, recover and learn. This measure is the operational side of the reporting duties of Article 23, with its 24-hour, 72-hour and one-month deadlines. Evidence: the procedure, the incident register, post-incident reviews.
(c) Business continuity and crisis management
The directive names "backup management and disaster recovery, and crisis management". Evidence: backup scope and restore test reports, a continuity plan with tolerable downtimes, a recovery plan, a crisis organisation and the report of an exercise.
(d) Supply chain security
Security aspects of the relationship with each direct supplier or service provider. Article 21(3) asks entities to take into account each supplier's specific vulnerabilities, the overall quality of its products and cybersecurity practices, including secure development, and the results of EU coordinated risk assessments under Article 22(1). Details in NIS 2 supply chain security.
(e) Security in acquisition, development and maintenance
Security requirements in purchases and projects, hardening, patching and "vulnerability handling and disclosure". Evidence: security clauses in specifications, patch records with lead times, a vulnerability management procedure and a published contact point for reporting flaws.
Measures f to j: effectiveness, hygiene, cryptography, HR and access, MFA
(f) Assessing effectiveness
"Policies and procedures to assess the effectiveness of cybersecurity risk-management measures": indicators, internal audits, penetration tests, a management review. Evidence: audit reports, a dashboard and the action plan that follows.
(g) Basic cyber hygiene and training
Recital 89 gives examples of hygiene: zero-trust principles, software updates, device configuration, network segmentation, identity and access management, user awareness. Evidence: training records, awareness material, configuration standards. Management training is a separate duty under Article 20(2).
(h) Cryptography and, where appropriate, encryption
A policy that says which algorithms and protocols are allowed, where data are encrypted at rest and in transit, and how keys and certificates are managed. Evidence: the policy, an inventory of keys and certificates with renewal dates.
(i) Human resources security, access control and asset management
Joiners, movers and leavers; least privilege; separate administrator accounts; an asset register with owners. Evidence: access reviews, the asset register, security clauses in employment documents.
(j) Multi-factor authentication and secured communications
"Multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems", where appropriate. Evidence: an MFA coverage report for remote and privileged access, the list of approved communication tools, a fallback means of contact for a crisis.
Proportionality: what "appropriate" means
Article 21(1) sets two tests. The measures must ensure a level of security "appropriate to the risks posed", taking into account the state of the art, relevant European and international standards where applicable, and the cost of implementation. Their proportionality is judged on the entity's exposure to risks, its size, and the likelihood and severity of incidents, including their societal and economic impact. Recital 82 adds the criticality of the entity. In practice, "appropriate" is a reasoned choice that you write down: a medium-sized entity does not need the tooling of a national operator, but it cannot skip one of the ten measures because it is inconvenient.
Three references help to calibrate. For DNS, cloud, data centre, managed service, online platform and trust service providers, Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 sets binding technical and methodological requirements. ENISA's NIS2 Technical Implementation Guidance of 26 June 2025 explains that regulation with practical advice and examples of evidence; other entities can read it as a benchmark. Article 25 asks Member States to encourage European and international standards without imposing a particular technology. And if a gap is found, Article 21(4) requires corrective measures "without undue delay": a dated gap list with owners is itself evidence.
Mapping to ISO/IEC 27001 controls
Many entities already run, or plan, an information security management system under ISO/IEC 27001:2022. The articles of the directive do not require certification, but recital 79 refers to standards "such as those included in the ISO/IEC 27000 series", and recital 58 points to ISO/IEC 30111 and ISO/IEC 29147 for vulnerability handling and disclosure. The requirements of ISO/IEC 27001 and its Annex A controls cover much of Article 21. The table maps each measure to the topics to look at; it does not replace reading the standard.
| Article 21(2) | ISO/IEC 27001:2022 topics to look at | What NIS 2 adds |
|---|---|---|
| (a) Risk analysis, policies | Leadership, information security risk assessment and treatment, policies for information security | All-hazards scope; approval by the management body (Article 20) |
| (b) Incident handling | Incident management planning, assessment, response, learning from incidents | 24-hour, 72-hour and one-month reporting (Article 23) |
| (c) Continuity | Information security during disruption, ICT readiness for business continuity, backup | Crisis management named explicitly |
| (d) Supply chain | Supplier relationships, supplier agreements, ICT supply chain, monitoring of supplier services | Account of EU coordinated risk assessments (Article 21(3)) |
| (e) Acquisition, development, maintenance | Secure development, technical vulnerability management, configuration management | Vulnerability disclosure |
| (f) Effectiveness | Monitoring and measurement, internal audit, management review | Evidence on request of the authority (Articles 32 and 33) |
| (g) Hygiene, training | Awareness, education and training; competence | Training of management body members (Article 20(2)) |
| (h) Cryptography | Use of cryptography | None specific |
| (i) HR, access, assets | Screening, terms of employment, access control and rights, inventory of assets | None specific |
| (j) MFA, secured communications | Secure authentication, information transfer | Secured emergency communication systems |
Certification under ISO/IEC 27001 is therefore a strong basis, but registration (Article 3(4)), management duties (Article 20) and reporting (Article 23) still need their own evidence. To score your position measure by measure, see NIS 2 gap assessment template; for the full list of obligations, the NIS 2 compliance checklist.
FAQ
Are the ten measures a complete list?
No, they are a minimum: Article 21(2) says the measures "shall include at least" points (a) to (j). National transposition laws and, for digital providers, Implementing Regulation (EU) 2024/2690 can add detail.
Does ISO/IEC 27001 certification mean NIS 2 compliance?
Not by itself. The articles of the directive do not require it, and certification does not cover the reporting deadlines of Article 23, the management duties of Article 20 or registration under Article 3(4). It does provide much of the evidence for Article 21.
Are the measures lighter for important entities?
No. Article 21 applies in the same terms to both categories. Proportionality depends on exposure to risks, size, and the likelihood and severity of incidents, not on the label.