Article 21's ten minimum measures
Ten measures, and the list is worth being able to recite: risk analysis and information-system security policies; incident handling; business continuity and crisis management; supply-chain security; security in acquisition, development and maintenance; policies to assess whether the measures work; basic cyber hygiene and training; cryptography and encryption; human-resources security, access control and asset management; and multi-factor authentication and secured communications.
Why it is like this
It is an *all-hazards* baseline expressed as outcomes rather than controls, so the same article can govern a hospital and a cloud provider. The proportionality clause then scales it: the measures must match the entity's exposure, size and the societal cost of a failure.
Not to be confused with
A control framework. Article 21 does not tell you which cipher, which backup window or which MFA factor. That is what mapping onto ISO 27001, CyberFundamentals or NIST is for — the directive sets the ends, the framework supplies the means.
In practice
An entity holding ISO 27001 usually finds nine of the ten already evidenced, and discovers the gap in (f): policies for assessing *whether the measures are effective*, which is a practice many certificate holders run thinly.
Source: Directive (EU) 2022/2555 (NIS2) — Art. 21(2). Read on .
Connects to
- GDPR — GDPR's Article 32 asks for 'appropriate technical and organisational measures' in one sentence. NIS2 spells out ten of them and applies them to the service, not only to personal data.
Say it back Check yourself
Name as many of the ten measures as you can, in any order.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- risk analysis and information system security policies
- incident handling
- business continuity, backup, disaster recovery, crisis management
- supply chain security
- security in acquisition, development and maintenance, including vulnerability handling
- policies to assess the effectiveness of the measures
- basic cyber hygiene and cybersecurity training
- cryptography and encryption policies
- human resources security, access control, asset management
- multi-factor authentication and secured communications
Ten is the number worth holding: when a client asks what NIS2 requires, the list is the answer, and the gaps are usually (d) supply chain and (f) measuring whether any of it works.