NIS2 Article 21(2) sets ten minimum cybersecurity risk-management measures for essential and important entities, from risk analysis policies to multi-factor authentication. The text is deliberately general, so engineering teams need to translate each point into owned, evidenced tasks. This checklist does that, one measure at a time.
Start with the legal frame
NIS2 is a directive, so each EU member state writes its own national law. Article 21(1) asks for measures that are "appropriate and proportionate" to the entity's risk exposure, size and the likely severity of incidents. Article 21(2) then says the measures must follow an all-hazards approach and include at least ten items. Check your national transposition for extra detail.
The ten measures, translated
Each item below is paraphrased from Article 21(2).
- Risk analysis and system security policies. A written policy, a risk register, and a review date. Someone senior owns it.
- Incident handling. A runbook, severity levels, on-call roles, and a log of past incidents.
- Business continuity. Backups that are tested by restoring them, disaster recovery plans, and a crisis management routine.
- Supply chain security. Know your direct suppliers, assess their security practices, and put security terms in contracts.
- Secure acquisition, development and maintenance, including vulnerability handling and disclosure. Code review, dependency scanning, patching, and a way for outsiders to report a flaw.
- Assessing effectiveness. Tests, audits and metrics that show whether the other measures work.
- Cyber hygiene and training. Awareness training for staff, and the basics done consistently.
- Cryptography and encryption policy. Where encryption is required, which algorithms, and how keys are managed.
- HR security, access control and asset management. Joiner, mover and leaver processes, least privilege, and an asset inventory.
- Multi-factor or continuous authentication, secured communications and emergency communication, where appropriate.
What auditors and regulators can ask for
Articles 32 and 33 give supervisors powers to request documented cybersecurity policies and "evidence of implementation", such as results of security audits. A policy alone will not answer that request. Keep dated artifacts: scan reports, restore test records, access review exports, training attendance, and meeting notes where management approved the measures.
Where to begin
Pick the three measures with the least current evidence and fix those first. For most software teams that is effectiveness assessment (item 6) and supply chain security (item 4), because both need records over time rather than a one-off document.
Article 21(4) also says that if an entity finds it does not comply, it must take corrective measures "without undue delay". Writing down gaps and dated remediation plans is therefore part of compliance, not an admission of failure.
Click through it at your own pace, or open it full screen.
Safeguard offers compliance and evidence automation and SBOM and dependency scanning, which can supply some of the artifacts above. It does not replace the policies and management decisions the directive asks for. You can try a free scan to see what dependency evidence looks like.
Quick check
Does NIS2 name specific technical controls?
Article 21(2) names measure categories, not products or settings. More detail comes from national law, and for some digital entity types from Commission Implementing Regulation 2024/2690.
Is Article 21 the same for essential and important entities?
Yes, the same Article 21 obligations apply to both. The difference is mainly in how supervision and fines work.
Sources
Last reviewed: 19 October 2026.
