NIS2 Article 21 Measure-to-Control Mapping Library
Gives each Article 21 risk-management measure in NIS2's words, what an entity must be able to show, and the CISO Times documents that support it.
Available soon
- Format
- Excel
- Size
- 63 KB
- Length
- 11 sheets
- Version
- 1.10
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.10
The mappings note no longer says the CISO Times Library shows a verification state; it says what a mapping shows and to confirm it against both texts.
- 1.9
Names the P27 documents.
- 1.8
Names the P26 documents.
Earlier versions (8)
- 1.7
Names the P25 documents.
- 1.6
Names the P24 documents.
- 1.5
Adds the P23 documents under measure (c), business continuity and backup management.
- 1.4
Names the P22 documents.
- 1.3
Lists the published security control assurance documents (P20) that support measure (f).
- 1.2
Lists the published security maturity assessment documents (P19) that support measure (f).
- 1.1
Lists the published access, privileged access and classification documents that support each measure.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook contains. The Measure Library has one row for each of the ten measures in Article 21(2) of NIS2, points (a) to (j): the measure's text, quoted from the Directive; what you should be able to show a supervisor for it, in our words; and the CISO Times documents that help with that work. The Article 21 sheet quotes the rest of the Article, and the Supporting Documents sheet lists the documents one per row so you can filter them. |
| 2 | What it does not contain. This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a NIS2 measure, so the last two columns are left for you. Where the CISO Times Library holds a mapping between a NIS2 measure and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A CISO Times document listed here helps with the work a measure describes; using it does not by itself show that the measure is met. |
| 3 | Why the title names controls. "NIS2 Article 21 Measure-to-Control Mapping Library" is this workbook's name in the CISO Times catalogue. The two columns headed "your own entry" are where you record the ISO/IEC 27001 controls and NIST CSF outcomes you use for each measure, if you run either. The workbook leaves them blank. What you write there is your own record and your own judgement: check it against the standards, and with your auditor or counsel where you rely on it. |
| 4 | For each measure, fill "Your policies, procedures and records" with the documents and records that put it in place for you, and name one owner. Each of the ten measures in Article 21(2) must have an owner, the documents that put it in place and records a supervisor could sample. The measures must be proportionate to the risks the risk assessment shows (Article 21(1)) (NR-06). |
| 5 | Use "What to be able to show" as the test: could you hand a supervisor each of those records today? Where you cannot, record the gap in the NIS2 Gap & Remediation Tracker (NR-09) and the evidence in the NIS2 Documentation & Evidence Checklist. |
| 6 | Open a supporting document from its CISO Times page. A CISO Times document is listed against a measure when its own framework references cite that point of Article 21(2). Planned packs are named without a link until their documents are published. Every measure is also helped by the NIS2 Readiness Self-Assessment, the NIS2 Documentation & Evidence Checklist, the NIS2 Gap & Remediation Tracker in this pack. |
| 7 | Read the Summary: how many documents support each measure, and which of your own columns are still empty. It counts what is filled in. It does not judge whether a measure is in place: the NIS2 Readiness Self-Assessment does that. |
| 8 | Review the library when the management body approves the measures again, at least once a year (NR-03). To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column. The measures stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
National law: [[national law transposing NIS2: title, number and date]]. It may add to the measures or set them out in more detail: record anything it adds in "Your policies, procedures and records" (NR-12).
Cloud, data centre, managed service and the other digital providers named in Article 1 of Implementing Regulation (EU) 2024/2690 must also apply the detailed requirements in its Annex to each measure. For every other entity the Regulation does not apply. See the Article 21 sheet.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, in wholesale distribution of food and catering supplies to businesses; important under NIS2 (scope assessment row ST-13). "Your policies, procedures and records" and "Owner" show its records as at 30 Sep 2026, the date of its readiness self-assessment. The example leaves the two "your own entry" columns blank, as you receive them.
Tailoring — small organisation: one owner may hold several measures, and one document may serve several. Keep each row filled, so a supervisor can follow each measure to its records.
Tailoring — financial entity: where DORA applies, NIS2's risk-management and reporting duties give way to DORA's (NIS2 Article 4(1)). Confirm with counsel before you use this library for a DORA entity.
Tailoring — IT run by a service provider: where the provider runs a measure for you, the measure is still yours. Name the provider and the contract in your records, and name your own owner.
Measure Library
The ten measures of NIS2 Article 21(2). The measure's text is the Directive's; what to show is ours. Yellow columns are yours.
This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a NIS2 measure, so the last two columns are left for you. Where the CISO Times Library holds a mapping between a NIS2 measure and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A CISO Times document listed here helps with the work a measure describes; using it does not by itself show that the measure is met.
| Row | Point | Measure | Article 21(2) text | What to be able to show | CISO Times documents that support it | Your policies, procedures and records | Owner | ISO/IEC 27001:2022 controls you use for it (your own entry) | NIST CSF 2.0 outcomes you use for it (your own entry) |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | (a) | Risk analysis and security policies | “policies on risk analysis and information system security” | • An approved information security policy and topic policies, reviewed on a set cycle • A risk assessment method and a current risk register, with the treatment chosen for each risk and who accepted what remains | P02-A02 Security Exception & Waiver Standard P02-A03 Exception Lifecycle Operating Procedure P04-A02 Policy Framework Standard P04-A03 Policy Lifecycle Operating Procedure P04-A05 Security Policy Hierarchy & Document Map P04-A08 Policy Coverage Gap Assessment P05-A02 Risk Assessment Methodology & Scoring Model P27-A02 First 90 Days Security Leader Checklist P27-A03 Inherited Security Programme Discovery Workbook | Risk register of 12 top risks reviewed at quarter end, with treatment and acceptance records (P05). | Head of Information Security | ||
| EXAMPLE | (b) | Incident handling | “incident handling” | • An incident management policy and a response plan, with roles and decision rights • A log of incidents with the reporting decision recorded for each, and reviews after serious ones | P09-A02 Security Incident Management Policy P09-A03 Incident Response Plan P09-A12 Incident Response Readiness Checklist P10-A03 Exercise Planning & Facilitation Procedure P10-A04 Tabletop Scenario — Ransomware Encryption of Core Systems P10-A06 Tabletop Scenario — Insider Data Exfiltration P10-A07 Tabletop Scenario — Cloud Tenant Account Takeover P10-A08 Tabletop Scenario — Executive Payment Fraud P27-A02 First 90 Days Security Leader Checklist P27-A03 Inherited Security Programme Discovery Workbook P27-A05 Security Function Handover Document | Incident policy and plan in use: 4 of 4 reports made on time in the quarter (P09 IMM-02). | Head of Information Security | ||
| EXAMPLE | (c) | Business continuity and crisis management | “business continuity, such as backup management and disaster recovery, and crisis management” | • Backup arrangements for critical systems, with restore tests recorded • Continuity and recovery plans for critical services, with recovery times • A crisis management arrangement that has been exercised | P09-A03 Incident Response Plan P09-A12 Incident Response Readiness Checklist P10-A04 Tabletop Scenario — Ransomware Encryption of Core Systems P10-A05 Tabletop Scenario — Critical Supplier Outage P22-A02 Business Continuity & ICT Resilience Policy P22-A03 Cyber Recovery Operating Procedure P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A05 Cyber Recovery Plan Template P22-A06 Clean-Room Recovery & Rebuild Checklist P22-A07 Resilience Dependency Register P22-A08 Crisis & Recovery Responsibility Matrix P22-A09 Resilience Readiness Dashboard P23-A02 Restore Testing Methodology P23-A03 Backup Operations & Restore Test Procedure P23-A04 Backup Coverage & Retention Matrix P23-A05 Restore Test Workbook P23-A06 Immutable & Offline Backup Protection Checklist P23-A07 Backup Failure & Restore Findings Tracker P23-A08 Restore Test Evidence Report Template P23-A09 Backup Assurance Dashboard | 2 of 5 critical services restored in tests (P03 BM-06); rebuilding the ordering platform's recovery (P05 TA-01) is awaiting board approval. | Head of IT | ||
| EXAMPLE | (d) | Supply chain security | “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | • A register of direct suppliers and service providers, tiered by how much the entity depends on them • Assessments and contract clauses in proportion to each tier, taking account of each supplier's own weaknesses and practices (Article 21(3)) | P06-A02 Third-Party Security Policy P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A10 Third-Party Risk Dashboard P24-A03 AI Use Case Intake & Approval Procedure P24-A07 AI Tool Approval & Data Permission Matrix P25-A06 AI Vendor & Model Provider Security Questionnaire P26-A02 Questionnaire Response Governance Method P26-A03 Questionnaire Intake, Drafting & Approval Procedure P26-A07 Questionnaire Request Tracker P27-A02 First 90 Days Security Leader Checklist P27-A03 Inherited Security Programme Discovery Workbook P27-A05 Security Function Handover Document | 9 of 14 critical suppliers assessed (P03 BM-05); the other 5 are booked by 8 Dec 2026 (P06). | Information Security Manager | ||
| EXAMPLE | (e) | Security in acquisition, development and maintenance | “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” | • Security requirements applied when systems are bought, built or changed • Vulnerabilities found, rated and fixed within set times, with the record • A way for outsiders to report a vulnerability, and how disclosure is handled | P01-A02 Vulnerability & Exposure Management Standard P01-A03 Vulnerability Triage & Remediation Operating Procedure P01-A04 Vulnerability Risk Rating & SLA Model P01-A05 Scan Coverage & Asset Scope Register P01-A06 Vulnerability Remediation Tracker P17-A02 Patch Management Standard P17-A03 Monthly Patch Cycle Operating Procedure P17-A05 Emergency Out-of-Band Patching Procedure P17-A08 Patch Compliance Dashboard P25-A02 Generative AI Security Standard P25-A03 LLM Application Security Review Procedure P25-A07 AI Red Team Test Plan Template Planned: P29 Secure Configuration, Hardening & Baselines | Critical exposure fixed on time: 81% against a target of 95% by deadline (Priority 1 in 7 days, Priority 2 in 14) (P03 BM-02); the action to bring it back (P05 TA-03) is at risk. | Head of IT | ||
| EXAMPLE | (f) | Assessing effectiveness | “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | • Measures of whether the security measures work, reported to management on a set cycle • Reviews, audits or exercises, with what they found and what was done about it | P01-A08 Vulnerability Management Metrics Workbook P01-A09 Vulnerability Programme Maturity Self-Assessment P04-A05 Security Policy Hierarchy & Document Map P04-A08 Policy Coverage Gap Assessment P04-A10 Policy Health & Attestation Reporting Workbook P10-A02 Tabletop Exercise Design Methodology P10-A11 Exercise Observations & Improvement Tracker P10-A12 Exercise After-Action Report Template P11-A02 Security Metric Definition & Measurement Method P11-A03 Security KPI & KRI Catalogue P11-A05 Metrics Data Collection & Quality Workbook P11-A06 Operational Security Metrics Dashboard P11-A10 Metrics Programme Maturity Self-Check P19-A02 Security Maturity Model & Scoring Method P19-A03 Internal Security Assessment Procedure P19-A04 Security Programme Maturity Assessment P19-A05 Assessment Evidence Request Checklist P19-A07 Maturity Assessment Report Template P19-A09 Maturity Results Executive Summary Deck P20-A02 Control Testing Methodology P20-A03 Control Inventory & Ownership Register P20-A04 Unified Control Framework Mapping Workbook P20-A05 Control Test Execution Procedure P20-A06 Control Test Workpaper Template P20-A07 Control Evidence Standards Checklist P20-A09 Annual Control Testing Plan P20-A10 Control Assurance Dashboard P27-A02 First 90 Days Security Leader Checklist P27-A03 Inherited Security Programme Discovery Workbook P27-A07 100-Day Security Plan P27-A08 First-Year Security Operating Calendar P27-A10 Security Posture Baseline Scorecard | Quarterly board measures (P03), an exercise programme with after-action reports (P10) and quarterly incident measures (P09). | Head of Information Security | ||
| EXAMPLE | (g) | Cyber hygiene and training | “basic cyber hygiene practices and cybersecurity training” | • Basic rules for staff, such as updates, passwords, locking screens and safe use of email • Security awareness training for staff, with completion records | P04-A05 Security Policy Hierarchy & Document Map P04-A07 Policy Attestation & Acknowledgement Tracker P16-A02 Annual Security Awareness Plan P16-A03 Role-Based Security Training Matrix P16-A04 Awareness Campaign Communications Kit P16-A05 Phishing Simulation Programme Method P16-A06 New Joiner Security Induction Deck P16-A07 Training Completion & Evidence Register P16-A09 Human Risk Metrics Dashboard P24-A09 AI Literacy & Staff Training Plan P27-A02 First 90 Days Security Leader Checklist P27-A03 Inherited Security Programme Discovery Workbook P27-A08 First-Year Security Operating Calendar | Staff awareness training running with records, but short of its target: 92% of staff trained against a target of 95% (P03 BM-08). | HR Learning Lead | ||
| EXAMPLE | (h) | Cryptography and encryption | “policies and procedures regarding the use of cryptography and, where appropriate, encryption” | • A policy on when and how cryptography and encryption are used, and how keys are managed • Where encryption is not used for data that would call for it, the recorded reason and who accepted it | No published CISO Times document yet. | Encryption is in use, and RA-01 records the six unencrypted laptops the firm accepted (P05). There is no written policy on the use of cryptography and on key management; the Head of Information Security owns writing one. | Head of Information Security | ||
| EXAMPLE | (i) | People, access and assets | “human resources security, access control policies and asset management” | • Security steps when people join, move and leave • An access control policy and periodic access reviews, with what they removed • An inventory of the assets that matter | P02-A02 Security Exception & Waiver Standard P02-A07 Segregation of Duties Conflict Matrix P02-A08 SoD Conflict Review & Compensating Control Procedure P07-A02 Access Review Methodology P07-A05 Reviewer Instruction Pack & Campaign Communications P07-A09 Access Review Outcome Report Template P13-A02 Access Control Policy P13-A03 Joiner-Mover-Leaver Operating Procedure P13-A04 Role-Based Access Profile Matrix P13-A06 Leaver Access Removal Checklist P13-A08 Identity Lifecycle Responsibility Matrix P13-A09 Leaver Timeliness & Orphaned Account Report P14-A02 Privileged Access Standard P14-A03 Privileged Access Request, Elevation & Revocation Procedure P14-A04 Privileged & Service Account Inventory P14-A06 Privileged Access Control Review Workbook P14-A07 Privileged Session Review Record P14-A09 Privileged Access Metrics Dashboard P15-A02 Information Classification & Handling Policy P15-A03 Classification Level Handling Rules Matrix P15-A04 Classification & Labelling Procedure P15-A05 Information Asset Register P15-A06 Information Asset Classification Workbook P15-A07 Secure Information Disposal Checklist P15-A08 Classification Quick-Reference Card & Staff Briefing P15-A09 Information Ownership Responsibility Matrix P24-A02 AI Acceptable Use & Security Policy P24-A05 AI System & Use Case Inventory P25-A02 Generative AI Security Standard P25-A05 Generative AI Deployment Configuration Checklist P27-A02 First 90 Days Security Leader Checklist P27-A03 Inherited Security Programme Discovery Workbook P27-A05 Security Function Handover Document | Access review UAR-2026-Q3 closed on 29 Sep 2026 (P07); supplier and asset registers kept (P06). | Head of IT | ||
| EXAMPLE | (j) | Multi-factor authentication and secured communications | “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate” | • Where multi-factor or continuous authentication is used, and where it is not with the reason • How voice, video and text communications inside the entity are secured • A secured way to communicate in an emergency when normal systems are down | P14-A02 Privileged Access Standard P14-A05 Break-Glass Account Control Checklist Planned: P30 Email & Domain Security | Multi-factor authentication covers email and remote access, but by text message, which the attacker also phished in INC-2026-017 (P09). The out-of-hours route to the incident manager was fixed on 10 Sep 2026 and is drilled on 6 Oct 2026 (P09 PIA-05, P10). | Head of IT |
Supporting Documents
One row per measure and CISO Times document. A CISO Times document is listed against a measure when its own framework references cite that point of Article 21(2). Planned packs are named without a link until their documents are published.
| Point | Measure | CISO Times document | Pack | State |
|---|---|---|---|---|
| (a) | Risk analysis and security policies | P02-A02 Security Exception & Waiver Standard | P02 Security Exception, Waiver & Segregation of Duties | Published |
| (a) | Risk analysis and security policies | P02-A03 Exception Lifecycle Operating Procedure | P02 Security Exception, Waiver & Segregation of Duties | Published |
| (a) | Risk analysis and security policies | P04-A02 Policy Framework Standard | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P04-A03 Policy Lifecycle Operating Procedure | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P04-A05 Security Policy Hierarchy & Document Map | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P04-A08 Policy Coverage Gap Assessment | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P05-A02 Risk Assessment Methodology & Scoring Model | P05 Information Security Risk Management | Published |
| (a) | Risk analysis and security policies | P27-A02 First 90 Days Security Leader Checklist | P27 CISO Transition, Handover & First 90 Days | Published |
| (a) | Risk analysis and security policies | P27-A03 Inherited Security Programme Discovery Workbook | P27 CISO Transition, Handover & First 90 Days | Published |
| (b) | Incident handling | P09-A02 Security Incident Management Policy | P09 Security Incident Management | Published |
| (b) | Incident handling | P09-A03 Incident Response Plan | P09 Security Incident Management | Published |
| (b) | Incident handling | P09-A12 Incident Response Readiness Checklist | P09 Security Incident Management | Published |
| (b) | Incident handling | P10-A03 Exercise Planning & Facilitation Procedure | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (b) | Incident handling | P10-A04 Tabletop Scenario — Ransomware Encryption of Core Systems | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (b) | Incident handling | P10-A06 Tabletop Scenario — Insider Data Exfiltration | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (b) | Incident handling | P10-A07 Tabletop Scenario — Cloud Tenant Account Takeover | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (b) | Incident handling | P10-A08 Tabletop Scenario — Executive Payment Fraud | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (b) | Incident handling | P27-A02 First 90 Days Security Leader Checklist | P27 CISO Transition, Handover & First 90 Days | Published |
| (b) | Incident handling | P27-A03 Inherited Security Programme Discovery Workbook | P27 CISO Transition, Handover & First 90 Days | Published |
| (b) | Incident handling | P27-A05 Security Function Handover Document | P27 CISO Transition, Handover & First 90 Days | Published |
| (c) | Business continuity and crisis management | P09-A03 Incident Response Plan | P09 Security Incident Management | Published |
| (c) | Business continuity and crisis management | P09-A12 Incident Response Readiness Checklist | P09 Security Incident Management | Published |
| (c) | Business continuity and crisis management | P10-A04 Tabletop Scenario — Ransomware Encryption of Core Systems | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (c) | Business continuity and crisis management | P10-A05 Tabletop Scenario — Critical Supplier Outage | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (c) | Business continuity and crisis management | P22-A02 Business Continuity & ICT Resilience Policy | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A03 Cyber Recovery Operating Procedure | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A05 Cyber Recovery Plan Template | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A06 Clean-Room Recovery & Rebuild Checklist | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A07 Resilience Dependency Register | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A08 Crisis & Recovery Responsibility Matrix | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P22-A09 Resilience Readiness Dashboard | P22 Cyber Resilience & Recovery | Published |
| (c) | Business continuity and crisis management | P23-A02 Restore Testing Methodology | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A03 Backup Operations & Restore Test Procedure | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A04 Backup Coverage & Retention Matrix | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A05 Restore Test Workbook | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A06 Immutable & Offline Backup Protection Checklist | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A07 Backup Failure & Restore Findings Tracker | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A08 Restore Test Evidence Report Template | P23 Backup & Restore Assurance | Published |
| (c) | Business continuity and crisis management | P23-A09 Backup Assurance Dashboard | P23 Backup & Restore Assurance | Published |
| (d) | Supply chain security | P06-A02 Third-Party Security Policy | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P06-A04 Supplier Criticality & Tiering Model | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P06-A07 Supplier Contract Security Clause Library | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P06-A10 Third-Party Risk Dashboard | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P24-A03 AI Use Case Intake & Approval Procedure | P24 AI Security Governance & Acceptable Use | Published |
| (d) | Supply chain security | P24-A07 AI Tool Approval & Data Permission Matrix | P24 AI Security Governance & Acceptable Use | Published |
| (d) | Supply chain security | P25-A06 AI Vendor & Model Provider Security Questionnaire | P25 Generative AI Security | Published |
| (d) | Supply chain security | P26-A02 Questionnaire Response Governance Method | P26 Security Questionnaire & Due Diligence Response | Published |
| (d) | Supply chain security | P26-A03 Questionnaire Intake, Drafting & Approval Procedure | P26 Security Questionnaire & Due Diligence Response | Published |
| (d) | Supply chain security | P26-A07 Questionnaire Request Tracker | P26 Security Questionnaire & Due Diligence Response | Published |
| (d) | Supply chain security | P27-A02 First 90 Days Security Leader Checklist | P27 CISO Transition, Handover & First 90 Days | Published |
| (d) | Supply chain security | P27-A03 Inherited Security Programme Discovery Workbook | P27 CISO Transition, Handover & First 90 Days | Published |
| (d) | Supply chain security | P27-A05 Security Function Handover Document | P27 CISO Transition, Handover & First 90 Days | Published |
| (e) | Security in acquisition, development and maintenance | P01-A02 Vulnerability & Exposure Management Standard | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A03 Vulnerability Triage & Remediation Operating Procedure | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A04 Vulnerability Risk Rating & SLA Model | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A05 Scan Coverage & Asset Scope Register | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A06 Vulnerability Remediation Tracker | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P17-A02 Patch Management Standard | P17 Patch Management | Published |
| (e) | Security in acquisition, development and maintenance | P17-A03 Monthly Patch Cycle Operating Procedure | P17 Patch Management | Published |
| (e) | Security in acquisition, development and maintenance | P17-A05 Emergency Out-of-Band Patching Procedure | P17 Patch Management | Published |
| (e) | Security in acquisition, development and maintenance | P17-A08 Patch Compliance Dashboard | P17 Patch Management | Published |
| (e) | Security in acquisition, development and maintenance | P25-A02 Generative AI Security Standard | P25 Generative AI Security | Published |
| (e) | Security in acquisition, development and maintenance | P25-A03 LLM Application Security Review Procedure | P25 Generative AI Security | Published |
| (e) | Security in acquisition, development and maintenance | P25-A07 AI Red Team Test Plan Template | P25 Generative AI Security | Published |
| (e) | Security in acquisition, development and maintenance | — | P29 Secure Configuration, Hardening & Baselines | Planned pack: no documents yet |
| (f) | Assessing effectiveness | P01-A08 Vulnerability Management Metrics Workbook | P01 Vulnerability & Exposure Management | Published |
| (f) | Assessing effectiveness | P01-A09 Vulnerability Programme Maturity Self-Assessment | P01 Vulnerability & Exposure Management | Published |
| (f) | Assessing effectiveness | P04-A05 Security Policy Hierarchy & Document Map | P04 Security Policy Management | Published |
| (f) | Assessing effectiveness | P04-A08 Policy Coverage Gap Assessment | P04 Security Policy Management | Published |
| (f) | Assessing effectiveness | P04-A10 Policy Health & Attestation Reporting Workbook | P04 Security Policy Management | Published |
| (f) | Assessing effectiveness | P10-A02 Tabletop Exercise Design Methodology | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (f) | Assessing effectiveness | P10-A11 Exercise Observations & Improvement Tracker | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (f) | Assessing effectiveness | P10-A12 Exercise After-Action Report Template | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (f) | Assessing effectiveness | P11-A02 Security Metric Definition & Measurement Method | P11 Cybersecurity Metrics & Reporting Programme | Published |
| (f) | Assessing effectiveness | P11-A03 Security KPI & KRI Catalogue | P11 Cybersecurity Metrics & Reporting Programme | Published |
| (f) | Assessing effectiveness | P11-A05 Metrics Data Collection & Quality Workbook | P11 Cybersecurity Metrics & Reporting Programme | Published |
| (f) | Assessing effectiveness | P11-A06 Operational Security Metrics Dashboard | P11 Cybersecurity Metrics & Reporting Programme | Published |
| (f) | Assessing effectiveness | P11-A10 Metrics Programme Maturity Self-Check | P11 Cybersecurity Metrics & Reporting Programme | Published |
| (f) | Assessing effectiveness | P19-A02 Security Maturity Model & Scoring Method | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P19-A03 Internal Security Assessment Procedure | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P19-A04 Security Programme Maturity Assessment | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P19-A05 Assessment Evidence Request Checklist | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P19-A07 Maturity Assessment Report Template | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P19-A09 Maturity Results Executive Summary Deck | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P20-A02 Control Testing Methodology | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A03 Control Inventory & Ownership Register | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A04 Unified Control Framework Mapping Workbook | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A05 Control Test Execution Procedure | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A06 Control Test Workpaper Template | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A07 Control Evidence Standards Checklist | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A09 Annual Control Testing Plan | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P20-A10 Control Assurance Dashboard | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P27-A02 First 90 Days Security Leader Checklist | P27 CISO Transition, Handover & First 90 Days | Published |
| (f) | Assessing effectiveness | P27-A03 Inherited Security Programme Discovery Workbook | P27 CISO Transition, Handover & First 90 Days | Published |
| (f) | Assessing effectiveness | P27-A07 100-Day Security Plan | P27 CISO Transition, Handover & First 90 Days | Published |
| (f) | Assessing effectiveness | P27-A08 First-Year Security Operating Calendar | P27 CISO Transition, Handover & First 90 Days | Published |
| (f) | Assessing effectiveness | P27-A10 Security Posture Baseline Scorecard | P27 CISO Transition, Handover & First 90 Days | Published |
| (g) | Cyber hygiene and training | P04-A05 Security Policy Hierarchy & Document Map | P04 Security Policy Management | Published |
| (g) | Cyber hygiene and training | P04-A07 Policy Attestation & Acknowledgement Tracker | P04 Security Policy Management | Published |
| (g) | Cyber hygiene and training | P16-A02 Annual Security Awareness Plan | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A03 Role-Based Security Training Matrix | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A04 Awareness Campaign Communications Kit | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A05 Phishing Simulation Programme Method | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A06 New Joiner Security Induction Deck | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A07 Training Completion & Evidence Register | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A09 Human Risk Metrics Dashboard | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P24-A09 AI Literacy & Staff Training Plan | P24 AI Security Governance & Acceptable Use | Published |
| (g) | Cyber hygiene and training | P27-A02 First 90 Days Security Leader Checklist | P27 CISO Transition, Handover & First 90 Days | Published |
| (g) | Cyber hygiene and training | P27-A03 Inherited Security Programme Discovery Workbook | P27 CISO Transition, Handover & First 90 Days | Published |
| (g) | Cyber hygiene and training | P27-A08 First-Year Security Operating Calendar | P27 CISO Transition, Handover & First 90 Days | Published |
| (i) | People, access and assets | P02-A02 Security Exception & Waiver Standard | P02 Security Exception, Waiver & Segregation of Duties | Published |
| (i) | People, access and assets | P02-A07 Segregation of Duties Conflict Matrix | P02 Security Exception, Waiver & Segregation of Duties | Published |
| (i) | People, access and assets | P02-A08 SoD Conflict Review & Compensating Control Procedure | P02 Security Exception, Waiver & Segregation of Duties | Published |
| (i) | People, access and assets | P07-A02 Access Review Methodology | P07 User Access Review | Published |
| (i) | People, access and assets | P07-A05 Reviewer Instruction Pack & Campaign Communications | P07 User Access Review | Published |
| (i) | People, access and assets | P07-A09 Access Review Outcome Report Template | P07 User Access Review | Published |
| (i) | People, access and assets | P13-A02 Access Control Policy | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P13-A03 Joiner-Mover-Leaver Operating Procedure | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P13-A04 Role-Based Access Profile Matrix | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P13-A06 Leaver Access Removal Checklist | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P13-A08 Identity Lifecycle Responsibility Matrix | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P13-A09 Leaver Timeliness & Orphaned Account Report | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P14-A02 Privileged Access Standard | P14 Privileged Access Management | Published |
| (i) | People, access and assets | P14-A03 Privileged Access Request, Elevation & Revocation Procedure | P14 Privileged Access Management | Published |
| (i) | People, access and assets | P14-A04 Privileged & Service Account Inventory | P14 Privileged Access Management | Published |
| (i) | People, access and assets | P14-A06 Privileged Access Control Review Workbook | P14 Privileged Access Management | Published |
| (i) | People, access and assets | P14-A07 Privileged Session Review Record | P14 Privileged Access Management | Published |
| (i) | People, access and assets | P14-A09 Privileged Access Metrics Dashboard | P14 Privileged Access Management | Published |
| (i) | People, access and assets | P15-A02 Information Classification & Handling Policy | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A03 Classification Level Handling Rules Matrix | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A04 Classification & Labelling Procedure | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A05 Information Asset Register | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A06 Information Asset Classification Workbook | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A07 Secure Information Disposal Checklist | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A08 Classification Quick-Reference Card & Staff Briefing | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P15-A09 Information Ownership Responsibility Matrix | P15 Information Classification & Handling | Published |
| (i) | People, access and assets | P24-A02 AI Acceptable Use & Security Policy | P24 AI Security Governance & Acceptable Use | Published |
| (i) | People, access and assets | P24-A05 AI System & Use Case Inventory | P24 AI Security Governance & Acceptable Use | Published |
| (i) | People, access and assets | P25-A02 Generative AI Security Standard | P25 Generative AI Security | Published |
| (i) | People, access and assets | P25-A05 Generative AI Deployment Configuration Checklist | P25 Generative AI Security | Published |
| (i) | People, access and assets | P27-A02 First 90 Days Security Leader Checklist | P27 CISO Transition, Handover & First 90 Days | Published |
| (i) | People, access and assets | P27-A03 Inherited Security Programme Discovery Workbook | P27 CISO Transition, Handover & First 90 Days | Published |
| (i) | People, access and assets | P27-A05 Security Function Handover Document | P27 CISO Transition, Handover & First 90 Days | Published |
| (j) | Multi-factor authentication and secured communications | P14-A02 Privileged Access Standard | P14 Privileged Access Management | Published |
| (j) | Multi-factor authentication and secured communications | P14-A05 Break-Glass Account Control Checklist | P14 Privileged Access Management | Published |
| (j) | Multi-factor authentication and secured communications | — | P30 Email & Domain Security | Planned pack: no documents yet |
Article 21
Article 21 around the ten measures
The rest of Article 21, and the Implementing Regulation for the digital providers it binds, as the texts state them. The right-hand column says how each bears on this library.
| Provision | What it says | What it means for this library |
|---|---|---|
| NIS2 Article 21(1) | Article 21(1) — appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems | Size each measure to your risks, from your risk assessment. The library gives the minimum list, not how much is enough for you (NR-06). |
| NIS2 Article 21(2) | Article 21(2) — the measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least” the ten listed in points (a) to (j) | The ten rows of the Measure Library, in the Directive's order and words. |
| NIS2 Article 21(3) | Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development | Row (d): judge each direct supplier on its own weaknesses and practices, not on a standard questionnaire alone. |
| NIS2 Article 21(4) | Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures” | A measure you cannot yet show is a gap: record it in the NIS2 Gap & Remediation Tracker and correct it without undue delay (NR-09). |
| Implementing Regulation (EU) 2024/2690, Article 1 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | If you are one of these providers, the Regulation applies to you. For every other entity it does not. |
| Implementing Regulation (EU) 2024/2690, Article 2(1) | Article 2(1) — for those providers, the technical and methodological requirements of the measures in Article 21(2), points (a) to (j), are set out in the Annex to the Regulation | For those providers, read each measure with the matching part of the Regulation's Annex, and record how you apply it in "Your policies, procedures and records". |
| National law | [[national law transposing NIS2: title, number and date]] | National law may add to the measures or detail them. Check it against the official text and with counsel (NR-12). For Cyprus, check the law in force with the Digital Security Authority and counsel. On 29 September 2026 the Authority's legislation page listed the Security of Networks and Information Systems Law of 2020 (N.89(I)/2020), and no law transposing NIS2. |
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it.
Summary
Library summary
Calculated from the Measure Library and Supporting Documents. The counts say which cells are filled in. They do not say whether a measure is in place: rate that in the NIS2 Readiness Self-Assessment.
EXAMPLE: the example organisation's records, as at 2026-09-30. Clear the EXAMPLE entries to use your own.
| Measure | Published CISO Times documents | Planned packs | Your records named | Owner named | Your ISO/IEC 27001 entry | Your NIST CSF entry |
|---|---|---|---|---|---|---|
| (a) Risk analysis and security policies | 9 | 0 | Yes | Yes | No | No |
| (b) Incident handling | 11 | 0 | Yes | Yes | No | No |
| (c) Business continuity and crisis management | 20 | 0 | Yes | Yes | No | No |
| (d) Supply chain security | 13 | 0 | Yes | Yes | No | No |
| (e) Security in acquisition, development and maintenance | 12 | 1 | Yes | Yes | No | No |
| (f) Assessing effectiveness | 32 | 0 | Yes | Yes | No | No |
| (g) Cyber hygiene and training | 13 | 0 | Yes | Yes | No | No |
| (h) Cryptography and encryption | 0 | 0 | Yes | Yes | No | No |
| (i) People, access and assets | 33 | 0 | Yes | Yes | No | No |
| (j) Multi-factor authentication and secured communications | 2 | 1 | Yes | Yes | No | No |
| All ten measures | 145 | 2 | 10 of 10 | 10 of 10 | 0 of 10 | 0 of 10 |
9 of 10 measures have at least one published CISO Times document.
A measure with no published document is not a gap in your measures. It means CISO Times has not yet published a template for it. The Planned column names the packs that will.
Lists
| Point | State |
|---|---|
| (a) | Published |
| (b) | Planned pack: no documents yet |
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Article 21 measures | The cybersecurity risk-management measures of Article 21: appropriate and proportionate to the risks, and including at least the ten in Article 21(2), points (a) to (j). |
| Point | The letter of the measure in Article 21(2), (a) to (j). It is the measure's stable ID in every P12 document. |
| What to be able to show | The documents and records a supervisor would expect to see for the measure, in our words. They are what a competent authority may ask for (Articles 32(2) and 33(2)). |
| CISO Times documents that support it | A CISO Times document is listed against a measure when its own framework references cite that point of Article 21(2). Planned packs are named without a link until their documents are published. Listing a document says it helps with the work. It says nothing about whether a measure is in place. |
| Your own entry | The last two columns of the library: the ISO/IEC 27001 controls and NIST CSF outcomes you use for the measure, if you run either. The workbook leaves them blank. What you enter is your judgement. |
| Competent authority | The authority a Member State designates to supervise NIS2 (Article 8(1)). The entity registers with it, and it inspects, asks for evidence and enforces. |
| Management body | The body that directs the entity: the board of directors, or the management board in a two-tier structure. [[Where there is no board, the people national law makes responsible for running the entity.]] NIS2 does not define the term, so confirm with counsel what the national law counts. |
| Implementing Regulation (EU) 2024/2690 | The Commission's detailed requirements for the Article 21(2) measures. It binds only the digital providers its Article 1 names. |
| NR-nn | The pack's rules, NR-01 to NR-12, set out in the pack guide and quoted in each document. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Clear the EXAMPLE entries before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The whole library: the legal requirements of Article 21 identified and recorded, each with an owner |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole library: what Article 21 requires understood, and each measure managed by a named owner |
| NIS2 — Directive (EU) 2022/2555 | Article 21(1) — appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems | Article 21 sheet: measures sized to the risks (NR-06) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2) — the measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least” the ten listed in points (a) to (j) | Measure Library: the ten measures, (a) to (j) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(a) — “policies on risk analysis and information system security” | Measure Library, row (a) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling” | Measure Library, row (b) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | Measure Library, row (c) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | Measure Library, row (d) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(e) — “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” | Measure Library, row (e) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Measure Library, row (f) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | Measure Library, row (g) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(h) — “policies and procedures regarding the use of cryptography and, where appropriate, encryption” | Measure Library, row (h) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Measure Library, row (i) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(j) — “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate” | Measure Library, row (j) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development | Measure Library, row (d), and the Article 21 sheet: each direct supplier judged on its own practices |
| NIS2 — Directive (EU) 2022/2555 | Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures” | Article 21 sheet: a measure not yet shown is a gap to correct (NR-09) |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Article 21 sheet: the digital providers the Regulation binds |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 2(1) — for those providers, the technical and methodological requirements of the measures in Article 21(2), points (a) to (j), are set out in the Annex to the Regulation | Article 21 sheet: those providers read each measure with the Regulation's Annex |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.