NIS2 requirements under Art. 21: the ten measures
The minimum catalogue in Art. 21(2)
The measures in Art. 21(2) of the NIS2 Directive follow an all-hazards approach and must be appropriate to the state of the art and to the individual risk. The ten areas:
a) Risk analysis and information system security
Policies on risk analysis and on the security of information systems. All other security management builds on them.
b) Incident handling
Processes for detecting, handling and following up incidents, including reporting paths.
c) Business continuity
Backup management, disaster recovery and crisis management, so that operations continue even in a serious incident.
d) Supply chain security
Security aspects in the relationships with suppliers and service providers, including their security level.
e) Security in acquisition, development and maintenance
Secure acquisition, development and maintenance of networks and information systems, including vulnerability handling and disclosure.
f) Assessing effectiveness
Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures, for example through tests and exercises.
g) Cyber hygiene and training
Basic cyber hygiene practices and regular cybersecurity training for staff and management.
h) Cryptography and encryption
Policies and procedures on the use of cryptography and, where appropriate, encryption.
i) Human resources, access control and asset management
Human resources security, access control policies and asset management.
j) MFA and secured communications
Multi-factor authentication, secured voice, video and text communications and secured emergency communication systems.
How is Art. 21 transposed nationally?
The national transposition laws have adopted the catalogue largely unchanged, some almost word for word, others with adapted wording. What applies to you is the law of the member state in which the entity is established, including its documentation requirements and its rules on the training and oversight duties of management. For certain types of digital infrastructure (cloud, DNS, managed service and managed security service providers and others), the Implementing Regulation (EU) 2024/2690 specifies the technical and methodological requirements uniformly across the EU and takes precedence as far as it reaches.
Where SecDrills helps in practice
Four of the ten areas are particularly well covered by tabletop exercises. In b) and c) your team rehearses handling incidents and acting in a crisis. For f), repeated and evaluated exercises evidence effectiveness. And for g), staff and management are trained and sensitised in the exercise. Every exercise ends with an after-action report that documents this evidence.
The overall picture is in the NIS2 overview. Whether you are in scope depends on your sector and size and on the law of your member state.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.