Hygiene, training, cryptography, MFA
Four of the ten are things a reader often assumes are implied rather than required: basic cyber hygiene practices and cybersecurity training; policies on the use of cryptography and, where appropriate, encryption; human-resources security, access control and asset management; and multi-factor authentication, together with secured voice, video and text communications.
Why it is like this
Named explicitly, they stop being optional maturity items that a budget round can defer. A supervisor can ask for the MFA rollout and the training records as evidence, and 'we plan to' is not one.
Not to be confused with
A rule that everything must be encrypted and everyone must use MFA. The article asks for *policies on their use*, proportionate to risk — a decision you have taken and can defend, not a blanket technical mandate.
In practice
An entity with MFA on administrator accounts but not on the staff VPN has a defensible position only if a documented risk assessment says so. With no policy at all, it has nothing to show.
Source: Directive (EU) 2022/2555 (NIS2) — Art. 21(2)(g), (h), (i), (j). Read on .
Odd one out Check yourself
Three of these are named outright in Article 21(2). Which is not?
Show the answer
An annual third-party penetration test
Penetration testing is a common way to satisfy (f) — assessing whether the measures are effective — but the article does not name it. MFA, training and cryptography policies are named.