NIS2 Article 21 Measure-to-Control Mapping Library
Gives each Article 21 risk-management measure in NIS2's words, what an entity must be able to show, and the CISO Times documents that support it.
Available soon
- Format
- Excel
- Size
- 60 KB
- Length
- 11 sheets
- Version
- 1.14
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook contains. The Measure Library has one row for each of the ten measures in Article 21(2) of NIS2, points (a) to (j): the measure's text, quoted from the Directive; what you should be able to show a supervisor for it, in our words; and the CISO Times documents that help with that work. The Article 21 sheet quotes the rest of the Article, and the Supporting Documents sheet lists the documents one per row so you can filter them. |
| 2 | What it does not contain. This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a NIS2 measure, so the last two columns are left for you. Where the CISO Times Library holds a mapping between a NIS2 measure and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A CISO Times document listed here helps with the work a measure describes; using it does not by itself show that the measure is met. |
| 3 | Why the title names controls. "NIS2 Article 21 Measure-to-Control Mapping Library" is this workbook's name in the CISO Times catalogue. The two columns headed "your own entry" are where you record the ISO/IEC 27001 controls and NIST CSF outcomes you use for each measure, if you run either. The workbook leaves them blank. What you write there is your own record and your own judgement: check it against the standards, and with your auditor or counsel where you rely on it. |
| 4 | For each measure, fill "Your policies, procedures and records" with the documents and records that put it in place for you, and name one owner. Each of the ten measures in Article 21(2) must have an owner, the documents that put it in place and records a supervisor could sample. The measures must be proportionate to the risks the risk assessment shows (Article 21(1)) (NR-06). |
| 5 | Use "What to be able to show" as the test: could you hand a supervisor each of those records today? Where you cannot, record the gap in the NIS2 Gap & Remediation Tracker (NR-09) and the evidence in the NIS2 Documentation & Evidence Checklist. |
| 6 | Open a supporting document from its CISO Times page. A CISO Times document is listed against a measure when its own framework references cite that point of Article 21(2). The library lists the three to five that most directly produce the policy, procedure or record the measure asks you to be able to show; other documents also cite the point, and each document's own reference table says where. Planned packs are named without a link until their documents are published. Every measure is also helped by the NIS2 Readiness Self-Assessment, the NIS2 Documentation & Evidence Checklist, the NIS2 Gap & Remediation Tracker in this pack. |
| 7 | Read the Summary: how many documents support each measure, and which of your own columns are still empty. It counts what is filled in. It does not judge whether a measure is in place: the NIS2 Readiness Self-Assessment does that. |
| 8 | Review the library when the management body approves the measures again, at least once a year (NR-03). To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow column. The measures stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it. A Commission proposal of January 2026 to amend the Directive, including its scope, is pending before the European Parliament and the Council; it is a proposal, not law, and this document applies the Directive as it stands.
National law: [[national law transposing NIS2: title, number and date]]. It may add to the measures or set them out in more detail: record anything it adds in "Your policies, procedures and records" (NR-12).
Cloud, data centre, managed service and the other digital providers named in Article 1 of Implementing Regulation (EU) 2024/2690 must also apply the detailed requirements in its Annex to each measure. Where the Annex says a requirement applies 'where appropriate', 'where applicable' or 'to the extent feasible', and such a provider decides it is not appropriate, applicable or feasible, Article 2(2) of the Regulation requires it to document its reasoning in a comprehensible manner: keep that note with the measure's records. For every other entity the Regulation does not apply. See the Article 21 sheet.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, in wholesale distribution of food and catering supplies to businesses; important under NIS2 (scope assessment row ST-13). "Your policies, procedures and records" and "Owner" show its records as at 30 Sep 2026, the date of its readiness self-assessment. The example leaves the two "your own entry" columns blank, as you receive them.
Tailoring — small organisation: one owner may hold several measures, and one document may serve several. Keep each row filled, so a supervisor can follow each measure to its records.
Tailoring — financial entity: where DORA applies, NIS2's risk-management and reporting duties give way to DORA's (NIS2 Article 4(1)). Confirm with counsel before you use this library for a DORA entity.
Tailoring — IT run by a service provider: where the provider runs a measure for you, the measure is still yours. Name the provider and the contract in your records, and name your own owner.
Measure Library
The ten measures of NIS2 Article 21(2). The measure's text is the Directive's; what to show is ours. Yellow columns are yours.
This library does not say which ISO/IEC 27001 controls or NIST CSF outcomes meet a NIS2 measure, so the last two columns are left for you. Where the CISO Times Library holds a mapping between a NIS2 measure and a control, it shows it there with how closely the two match and where they differ; confirm it against both texts before relying on it. A CISO Times document listed here helps with the work a measure describes; using it does not by itself show that the measure is met.
| Row | Point | Measure | Article 21(2) text | What to be able to show | CISO Times documents that support it | Your policies, procedures and records | Owner | ISO/IEC 27001:2022 controls you use for it (your own entry) | NIST CSF 2.0 outcomes you use for it (your own entry) |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | (a) | Risk analysis and security policies | “policies on risk analysis and information system security” | • An approved information security policy and topic policies, reviewed on a set cycle • A risk assessment method and a current risk register, with the treatment chosen for each risk and who accepted what remains | P04-A02 Policy Framework Standard P04-A03 Policy Lifecycle Operating Procedure P04-A05 Security Policy Hierarchy & Document Map P05-A02 Risk Assessment Methodology & Scoring Model P02-A02 Security Exception & Waiver Standard | Risk register of 12 top risks reviewed at quarter end, with treatment and acceptance records (P05). | Head of Information Security | ||
| EXAMPLE | (b) | Incident handling | “incident handling” | • An incident management policy and a response plan, with roles and decision rights • A log of incidents with the reporting decision recorded for each, and reviews after serious ones | P09-A02 Security Incident Management Policy P09-A03 Incident Response Plan P09-A12 Incident Response Readiness Checklist P10-A03 Exercise Planning & Facilitation Procedure | Incident policy and plan in use: 4 of 4 reports made on time in the quarter (P09 IMM-02). | Head of Information Security | ||
| EXAMPLE | (c) | Business continuity and crisis management | “business continuity, such as backup management and disaster recovery, and crisis management” | • Backup arrangements for critical systems, with restore tests recorded • Continuity and recovery plans for critical services, with recovery times • A crisis management arrangement that has been exercised | P22-A02 Business Continuity & ICT Resilience Policy P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A12 IT Disaster Recovery Procedure P22-A13 Continuity & Disaster Recovery Test Plan and Report P23-A03 Backup Operations & Restore Test Procedure | 2 of 5 critical services restored in tests (P03 BM-06); rebuilding the ordering platform's recovery (P05 TA-01) is awaiting board approval. | Head of IT | ||
| EXAMPLE | (d) | Supply chain security | “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | • A register of direct suppliers and service providers, tiered by how much the entity depends on them • Assessments and contract clauses in proportion to each tier, taking account of each supplier's own weaknesses and practices (Article 21(3)) • Where the coordinated security risk assessments of critical supply chains under Article 22(1) apply to a supplier, how their results were taken into account (Article 21(3), second sentence) • For a supplier that is itself an NIS2 entity, the same assessment: Article 21(3) names no exception for it | P06-A02 Third-Party Security Policy P06-A04 Supplier Criticality & Tiering Model P06-A07 Supplier Contract Security Clause Library P06-A10 Third-Party Risk Dashboard | 9 of 14 critical suppliers assessed (P03 BM-05); the other 5 are booked by 8 Dec 2026 (P06). | Information Security Manager | ||
| EXAMPLE | (e) | Security in acquisition, development and maintenance | “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” | • Security requirements applied when systems are bought, built or changed • Vulnerabilities found, rated and fixed within set times, with the record • A way for outsiders to report a vulnerability, and how disclosure is handled | P01-A02 Vulnerability & Exposure Management Standard P01-A03 Vulnerability Triage & Remediation Operating Procedure P01-A04 Vulnerability Risk Rating & SLA Model P01-A06 Vulnerability Remediation Tracker P17-A02 Patch Management Standard Planned: P29 Secure Configuration, Hardening & Baselines | Critical exposure fixed on time: 81% against a target of 95% by deadline (Priority 1 in 7 days, Priority 2 in 14) (P03 BM-02); the action to bring it back (P05 TA-03) is at risk. | Head of IT | ||
| EXAMPLE | (f) | Assessing effectiveness | “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | • Measures of whether the security measures work, reported to management on a set cycle • Reviews, audits or exercises, with what they found and what was done about it | P11-A03 Security KPI & KRI Catalogue P20-A02 Control Testing Methodology P19-A03 Internal Security Assessment Procedure P10-A12 Exercise After-Action Report Template P10-A11 Exercise Observations & Improvement Tracker | Quarterly board measures (P03), an exercise programme with after-action reports (P10) and quarterly incident measures (P09). | Head of Information Security | ||
| EXAMPLE | (g) | Cyber hygiene and training | “basic cyber hygiene practices and cybersecurity training” | • Basic rules for staff, such as updates, passwords, locking screens and safe use of email • Security awareness training for staff, with completion records | P16-A02 Annual Security Awareness Plan P16-A03 Role-Based Security Training Matrix P16-A07 Training Completion & Evidence Register P04-A07 Policy Attestation & Acknowledgement Tracker P16-A06 New Joiner Security Induction Deck | Staff awareness training running with records, but short of its target: 92% of staff trained against a target of 95% (P03 BM-08). | HR Learning Lead | ||
| EXAMPLE | (h) | Cryptography and encryption | “policies and procedures regarding the use of cryptography and, where appropriate, encryption” | • A policy on when and how cryptography and encryption are used, and how keys are managed • Where encryption is not used for data that would call for it, the recorded reason and who accepted it | No published CISO Times document yet. | Encryption is in use, and RA-01 records the six unencrypted laptops the firm accepted (P05). There is no written policy on the use of cryptography and on key management; the Head of Information Security owns writing one. | Head of Information Security | ||
| EXAMPLE | (i) | People, access and assets | “human resources security, access control policies and asset management” | • Security steps when people join, move and leave • An access control policy and periodic access reviews, with what they removed • An inventory of the assets that matter | P13-A02 Access Control Policy P13-A03 Joiner-Mover-Leaver Operating Procedure P07-A02 Access Review Methodology P07-A09 Access Review Outcome Report Template P15-A05 Information Asset Register | Access review UAR-2026-Q3 closed on 29 Sep 2026 (P07); supplier and asset registers kept (P06). | Head of IT | ||
| EXAMPLE | (j) | Multi-factor authentication and secured communications | “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate” | • Where multi-factor or continuous authentication is used, and where it is not with the reason • How voice, video and text communications inside the entity are secured • A secured way to communicate in an emergency when normal systems are down | P14-A02 Privileged Access Standard P14-A05 Break-Glass Account Control Checklist Planned: P30 Email & Domain Security | Multi-factor authentication covers email and remote access, but by text message, which the attacker also phished in INC-2026-017 (P09). The out-of-hours route to the incident manager was fixed on 10 Sep 2026 and is drilled on 6 Oct 2026 (P09 PIA-05, P10). | Head of IT |
Supporting Documents
One row per measure and CISO Times document. A CISO Times document is listed against a measure when its own framework references cite that point of Article 21(2). The library lists the three to five that most directly produce the policy, procedure or record the measure asks you to be able to show; other documents also cite the point, and each document's own reference table says where. Planned packs are named without a link until their documents are published.
| Point | Measure | CISO Times document | Pack | State |
|---|---|---|---|---|
| (a) | Risk analysis and security policies | P04-A02 Policy Framework Standard | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P04-A03 Policy Lifecycle Operating Procedure | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P04-A05 Security Policy Hierarchy & Document Map | P04 Security Policy Management | Published |
| (a) | Risk analysis and security policies | P05-A02 Risk Assessment Methodology & Scoring Model | P05 Information Security Risk Management | Published |
| (a) | Risk analysis and security policies | P02-A02 Security Exception & Waiver Standard | P02 Security Exception, Waiver & Segregation of Duties | Published |
| (b) | Incident handling | P09-A02 Security Incident Management Policy | P09 Security Incident Management | Published |
| (b) | Incident handling | P09-A03 Incident Response Plan | P09 Security Incident Management | Published |
| (b) | Incident handling | P09-A12 Incident Response Readiness Checklist | P09 Security Incident Management | Published |
| (b) | Incident handling | P10-A03 Exercise Planning & Facilitation Procedure | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (c) | Business continuity and crisis management | P22-A02 Business Continuity & ICT Resilience Policy | P22 Business Continuity, Disaster Recovery & Cyber Resilience | Published |
| (c) | Business continuity and crisis management | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | P22 Business Continuity, Disaster Recovery & Cyber Resilience | Published |
| (c) | Business continuity and crisis management | P22-A12 IT Disaster Recovery Procedure | P22 Business Continuity, Disaster Recovery & Cyber Resilience | Published |
| (c) | Business continuity and crisis management | P22-A13 Continuity & Disaster Recovery Test Plan and Report | P22 Business Continuity, Disaster Recovery & Cyber Resilience | Published |
| (c) | Business continuity and crisis management | P23-A03 Backup Operations & Restore Test Procedure | P23 Backup & Restore Assurance | Published |
| (d) | Supply chain security | P06-A02 Third-Party Security Policy | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P06-A04 Supplier Criticality & Tiering Model | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P06-A07 Supplier Contract Security Clause Library | P06 Third-Party Security Risk Management | Published |
| (d) | Supply chain security | P06-A10 Third-Party Risk Dashboard | P06 Third-Party Security Risk Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A02 Vulnerability & Exposure Management Standard | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A03 Vulnerability Triage & Remediation Operating Procedure | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A04 Vulnerability Risk Rating & SLA Model | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P01-A06 Vulnerability Remediation Tracker | P01 Vulnerability & Exposure Management | Published |
| (e) | Security in acquisition, development and maintenance | P17-A02 Patch Management Standard | P17 Patch Management | Published |
| (e) | Security in acquisition, development and maintenance | — | P29 Secure Configuration, Hardening & Baselines | Planned pack: no documents yet |
| (f) | Assessing effectiveness | P11-A03 Security KPI & KRI Catalogue | P11 Cybersecurity Metrics & Reporting Programme | Published |
| (f) | Assessing effectiveness | P20-A02 Control Testing Methodology | P20 Security Control Assurance | Published |
| (f) | Assessing effectiveness | P19-A03 Internal Security Assessment Procedure | P19 Security Maturity & Internal Assessment | Published |
| (f) | Assessing effectiveness | P10-A12 Exercise After-Action Report Template | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (f) | Assessing effectiveness | P10-A11 Exercise Observations & Improvement Tracker | P10 Cyber Incident Exercises & Tabletop Scenario Library | Published |
| (g) | Cyber hygiene and training | P16-A02 Annual Security Awareness Plan | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A03 Role-Based Security Training Matrix | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P16-A07 Training Completion & Evidence Register | P16 Security Awareness Programme | Published |
| (g) | Cyber hygiene and training | P04-A07 Policy Attestation & Acknowledgement Tracker | P04 Security Policy Management | Published |
| (g) | Cyber hygiene and training | P16-A06 New Joiner Security Induction Deck | P16 Security Awareness Programme | Published |
| (i) | People, access and assets | P13-A02 Access Control Policy | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P13-A03 Joiner-Mover-Leaver Operating Procedure | P13 Joiner-Mover-Leaver & Access Provisioning | Published |
| (i) | People, access and assets | P07-A02 Access Review Methodology | P07 User Access Review | Published |
| (i) | People, access and assets | P07-A09 Access Review Outcome Report Template | P07 User Access Review | Published |
| (i) | People, access and assets | P15-A05 Information Asset Register | P15 Information Classification & Handling | Published |
| (j) | Multi-factor authentication and secured communications | P14-A02 Privileged Access Standard | P14 Privileged Access Management | Published |
| (j) | Multi-factor authentication and secured communications | P14-A05 Break-Glass Account Control Checklist | P14 Privileged Access Management | Published |
| (j) | Multi-factor authentication and secured communications | — | P30 Email & Domain Security | Planned pack: no documents yet |
Article 21
Article 21 around the ten measures
The rest of Article 21, and the Implementing Regulation for the digital providers it binds, as the texts state them. The right-hand column says how each bears on this library.
| Provision | What it says | What it means for this library |
|---|---|---|
| NIS2 Article 21(1) | Article 21(1) — appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems | Size each measure to your risks, from your risk assessment. The library gives the minimum list, not how much is enough for you (NR-06). |
| NIS2 Article 21(2) | Article 21(2) — the measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least” the ten listed in points (a) to (j) | The ten rows of the Measure Library, in the Directive's order and words. |
| NIS2 Article 21(3) | Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development | Row (d): judge each direct supplier on its own weaknesses and practices, not on a standard questionnaire alone. The second sentence of Article 21(3) also asks entities to take into account the results of the coordinated security risk assessments of critical supply chains carried out under Article 22(1). It names no exception for a supplier that is itself an NIS2 entity. |
| NIS2 Article 21(4) | Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures” | A measure you cannot yet show is a gap: record it in the NIS2 Gap & Remediation Tracker and correct it without undue delay (NR-09). |
| Implementing Regulation (EU) 2024/2690, Article 1 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | If you are one of these providers, the Regulation applies to you. For every other entity it does not. |
| Implementing Regulation (EU) 2024/2690, Article 2(1) | Article 2(1) — for those providers, the technical and methodological requirements of the measures in Article 21(2), points (a) to (j), are set out in the Annex to the Regulation | For those providers, read each measure with the matching part of the Regulation's Annex, and record how you apply it in "Your policies, procedures and records". |
| Implementing Regulation (EU) 2024/2690, Article 2(2) | Article 2(2) — where the Annex applies a requirement 'where appropriate', 'where applicable' or 'to the extent feasible', and the provider considers it not appropriate, not applicable or not feasible, it documents its reasoning in a comprehensible manner | For those providers, keep that reasoning with the measure's records, and note it in "Your policies, procedures and records". |
| National law | [[national law transposing NIS2: title, number and date]] | National law may add to the measures or detail them. Check it against the official text and with counsel (NR-12). Check the national law in force with your competent authority and counsel. A Member State may have transposed NIS2 by amending the law that transposed the earlier NIS Directive rather than by a new one: Cyprus, for example, amended its Security of Networks and Information Systems Law of 2020 (N.89(I)/2020) by Law 60(I)/2025, as the Digital Security Authority's consolidated text showed on 16 October 2026. |
This document helps you apply NIS2's own tests to your facts. It is not legal advice. National law may add to the Directive or define terms more closely, so confirm the result with counsel before you rely on it. A Commission proposal of January 2026 to amend the Directive, including its scope, is pending before the European Parliament and the Council; it is a proposal, not law, and this document applies the Directive as it stands.
Summary
Library summary
Calculated from the Measure Library and Supporting Documents. The counts say which cells are filled in. They do not say whether a measure is in place: rate that in the NIS2 Readiness Self-Assessment.
EXAMPLE: the example organisation's records, as at 2026-09-30. Clear the EXAMPLE entries to use your own.
| Measure | Published CISO Times documents | Planned packs | Your records named | Owner named | Your ISO/IEC 27001 entry | Your NIST CSF entry |
|---|---|---|---|---|---|---|
| (a) Risk analysis and security policies | 5 | 0 | Yes | Yes | No | No |
| (b) Incident handling | 4 | 0 | Yes | Yes | No | No |
| (c) Business continuity and crisis management | 5 | 0 | Yes | Yes | No | No |
| (d) Supply chain security | 4 | 0 | Yes | Yes | No | No |
| (e) Security in acquisition, development and maintenance | 5 | 1 | Yes | Yes | No | No |
| (f) Assessing effectiveness | 5 | 0 | Yes | Yes | No | No |
| (g) Cyber hygiene and training | 5 | 0 | Yes | Yes | No | No |
| (h) Cryptography and encryption | 0 | 0 | Yes | Yes | No | No |
| (i) People, access and assets | 5 | 0 | Yes | Yes | No | No |
| (j) Multi-factor authentication and secured communications | 2 | 1 | Yes | Yes | No | No |
| All ten measures | 40 | 2 | 10 of 10 | 10 of 10 | 0 of 10 | 0 of 10 |
9 of 10 measures have at least one published CISO Times document.
A measure with no published document is not a gap in your measures. It means CISO Times has not yet published a template for it. The Planned column names the packs that will.
Lists
| Point | State |
|---|---|
| (a) | Published |
| (b) | Planned pack: no documents yet |
(c)
(d)
(e)
(f)
(g)
(h)
(i)
(j)
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Article 21 measures | The cybersecurity risk-management measures of Article 21: appropriate and proportionate to the risks, and including at least the ten in Article 21(2), points (a) to (j). |
| Point | The letter of the measure in Article 21(2), (a) to (j). It is the measure's stable ID in every P12 document. |
| What to be able to show | The documents and records a supervisor would expect to see for the measure, in our words. They are what a competent authority may ask for (Articles 32(2) and 33(2)). |
| CISO Times documents that support it | A CISO Times document is listed against a measure when its own framework references cite that point of Article 21(2). The library lists the three to five that most directly produce the policy, procedure or record the measure asks you to be able to show; other documents also cite the point, and each document's own reference table says where. Planned packs are named without a link until their documents are published. Listing a document says it helps with the work. It says nothing about whether a measure is in place. |
| Your own entry | The last two columns of the library: the ISO/IEC 27001 controls and NIST CSF outcomes you use for the measure, if you run either. The workbook leaves them blank. What you enter is your judgement. |
| Competent authority | The authority a Member State designates to supervise NIS2 (Article 8(1)). The entity registers with it, and it inspects, asks for evidence and enforces. |
| Management body | The body that directs the entity and oversees its management: the board of directors; in a two-tier structure, the management board, and the supervisory board as well where the law that governs the entity counts it; where there is no board, the people who run the entity, such as its managing directors or partners. NIS2 does not define the term, so confirm with counsel what the national law counts. |
| Implementing Regulation (EU) 2024/2690 | The Commission's detailed requirements for the Article 21(2) measures. It binds only the digital providers its Article 1 names. |
| NR-nn | The pack's rules, NR-01 to NR-12, set out in the pack guide and quoted in each document. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 2026-09-30. Clear the EXAMPLE entries before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.31 — Legal, statutory, regulatory and contractual requirements | The whole library: the legal requirements of Article 21 identified and recorded, each with an owner |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole library: what Article 21 requires understood, and each measure managed by a named owner |
| NIS2 — Directive (EU) 2022/2555 | Article 21(1) — appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems | Article 21 sheet: measures sized to the risks (NR-06) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2) — the measures “shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least” the ten listed in points (a) to (j) | Measure Library: the ten measures, (a) to (j) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(a) — “policies on risk analysis and information system security” | Measure Library, row (a) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling” | Measure Library, row (b) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(c) — “business continuity, such as backup management and disaster recovery, and crisis management” | Measure Library, row (c) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | Measure Library, row (d) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(e) — “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” | Measure Library, row (e) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Measure Library, row (f) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | Measure Library, row (g) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(h) — “policies and procedures regarding the use of cryptography and, where appropriate, encryption” | Measure Library, row (h) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Measure Library, row (i) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(j) — “the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate” | Measure Library, row (j) |
| NIS2 — Directive (EU) 2022/2555 | Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development | Measure Library, row (d), and the Article 21 sheet: each direct supplier judged on its own practices |
| NIS2 — Directive (EU) 2022/2555 | Article 21(4) — an entity that finds that it does not comply with the measures in paragraph 2 takes, “without undue delay, all necessary, appropriate and proportionate corrective measures” | Article 21 sheet: a measure not yet shown is a gap to correct (NR-09) |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Article 21 sheet: the digital providers the Regulation binds |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 2(1) — for those providers, the technical and methodological requirements of the measures in Article 21(2), points (a) to (j), are set out in the Annex to the Regulation | Article 21 sheet: those providers read each measure with the Regulation's Annex |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Commission Recommendation 2003/361/EC; Implementing Regulation (EU) 2024/2690; ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any NIS2 requirement.