NIS2 · pillar 2 of 6
Obligations — the ten measures
Article 21 lists ten minimum measures; everything else is how you evidence them.
- 4 Article 21's ten minimum measures Ten measures, and the list is worth being able to recite: risk analysis and information-system security policies…
- 5 Your suppliers are your perimeter Supply-chain security is one of the ten measures, and it reaches further than buying from reputable vendors: you must…
- 6 Hygiene, training, cryptography, MFA Four of the ten are things a reader often assumes are implied rather than required: basic cyber hygiene practices and…
Start this pillar See the whole map
Sources: Directive (EU) 2022/2555 (NIS2), Belgian law of 26 April 2024 establishing a framework for the cybersecurity of networks and information systems, Centre for Cybersecurity Belgium — NIS2 and CyberFundamentals. Written from those texts and last checked on against reporting on them — not read line by line against the primary documents. Every card names the clause it comes from precisely so you can settle it at the source, and [email protected] is where a correction goes.