Article 21Cybersecurity risk-management measures
1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.
Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
(a) policies on risk analysis and information system security;
(b) incident handling;
(c) business continuity, such as backup management and disaster recovery, and crisis management;
(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
(e) security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
(f) policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
(g) basic cyber hygiene practices and cybersecurity training;
(h) policies and procedures regarding the use of cryptography and, where appropriate, encryption;
(i) human resources security, access control policies and asset management;
(j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.
3. Member States shall ensure that, when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. Member States shall also ensure that, when considering which measures referred to in that point are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with Article 22(1).
4. Member States shall ensure that an entity that finds that it does not comply with the measures provided for in paragraph 2 takes, without undue delay, all necessary, appropriate and proportionate corrective measures.
5. By 17 October 2024, the Commission shall adopt implementing acts laying down the technical and the methodological requirements of the measures referred to in paragraph 2 with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers.
The Commission may adopt implementing acts laying down the technical and the methodological requirements, as well as sectoral requirements, as necessary, of the measures referred to in paragraph 2 with regard to essential and important entities other than those referred to in the first subparagraph of this paragraph.
When preparing the implementing acts referred to in the first and second subparagraphs of this paragraph, the Commission shall, to the extent possible, follow European and international standards, as well as relevant technical specifications. The Commission shall exchange advice and cooperate with the Cooperation Group and ENISA on the draft implementing acts in accordance with Article 14(4), point (e).
Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 39(2).
NIS2, the European Union directive on network and information security, Article 21
Member States must ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems they use, and to prevent or minimise the impact of incidents on recipients of their services and on other services. The state of the art, relevant standards where applicable, and cost shape the level of security; proportionality looks at the entity’s exposure to risk, its size, and the likelihood and severity of incidents, including societal and economic impact.
The measures rest on an all-hazards approach covering the systems and their physical environment, and must include at least: (a) risk analysis and system security policies; (b) incident handling; (c) business continuity, such as backup management and disaster recovery, and crisis management; (d) supply chain security, including relationships with direct suppliers; (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure; (f) assessing whether the measures are effective; (g) basic cyber hygiene and training; (h) cryptography and, where appropriate, encryption; (i) human resources security, access control and asset management; (j) multi-factor or continuous authentication, secured communications and emergency communications, where appropriate.
Paragraph 3 adds that supplier measures should consider each direct supplier’s vulnerabilities and practices, and the results of Article 22 assessments. Paragraph 4 requires corrective measures without undue delay on finding non-compliance. Under paragraph 5, Commission Implementing Regulation (EU) 2024/2690 sets technical and methodological requirements for the entity types listed there; check its current text.
What is in the packs for this
Each one helps with this requirement.
NIS2 Article 21 Measure-to-Control Mapping LibraryExcel
in NIS2 Implementation & Readiness
The Measure Library takes the ten measures in order, (a) to (j), with what an entity should be able to show for each and the documents that help; the Article 21 sheet covers proportionality, suppliers and corrective measures.
NIS2 Readiness Self-AssessmentExcel
in NIS2 Implementation & Readiness
Readiness items RM-a to RM-j rate each of the ten measures, and the gap priorities and close-by dates follow the duty to correct a measure that is not in place.
Vulnerability & Exposure Management StandardWord
in Vulnerability & Exposure Management
Point (e): the standard covers vulnerability handling as part of keeping systems secure through acquisition, development and maintenance.
Risk Assessment Methodology & Scoring ModelWord
in Information Security Risk Management
Point (a): the risk assessment methodology is a policy on risk analysis, and it sizes the measures to the risk.
Third-Party Security PolicyWord
in Third-Party Security Risk Management
Point (d): the third-party security policy covers supply chain security and the regulated-entity tailoring.
in Security Incident Management
Points (b) and (c): the incident response plan covers incident handling, and its crisis team and recovery sections cover crisis management.
in Joiner-Mover-Leaver & Access Provisioning
Point (i): the access control policy covers access control and the rules for who may hold access, with regulated-entity tailoring.
Privileged Access StandardWord
in Privileged Access Management
Points (i) and (j): the standard covers privileged access control and phishing-resistant sign-in, which bears on multi-factor authentication.
Annual Security Awareness PlanExcel
in Security Awareness Programme
Point (g): the annual plan covers cybersecurity training and basic cyber hygiene for staff.
Control Testing MethodologyWord
in Security Control Assurance
Point (f): the method is a procedure for assessing the effectiveness of the security measures, one control at a time.
Business Continuity & ICT Resilience PolicyWord
in Cyber Resilience & Recovery
Point (c): the policy covers continuity, backups, recovery and crisis management, and ties recovery to limiting an incident's impact on the people who use the services.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.