NIS2 Compliance Checklist for SMBs: Article 21 Measure by Measure
What a small or mid-sized organisation needs in place under NIS2, in the order you would build it: scope, registration, governance, the ten minimum security measures of Article 21 and incident reporting. Each item names the article it comes from.
NIS2 (Directive (EU) 2022/2555) is a directive, so your obligations come from your country's national law, which may add detail. The checklist below follows the directive itself, which every national law must implement. If you have not yet confirmed that NIS2 applies to you, start with our NIS2 summary or the scope step of the free NIS2 Readiness Check.
1. Scope and registration
| Check | Article | What to have |
|---|---|---|
| Confirm you are in scope and in which category | Art. 2, 3 | A short note recording your sector (Annex I or II), size, and whether you are an essential or important entity |
| Register with your competent authority | Art. 3(4) | Name, address and contact details (including email addresses, IP ranges and telephone numbers), sector and subsector, and the member states where you provide services |
| Keep the registration current | Art. 3(4) | A process to notify changes without delay, and within two weeks at the latest |
| Digital providers: register for the ENISA registry | Art. 27 | DNS, TLD, cloud, data centre, CDN, managed (security) service providers, marketplaces, search engines and social networks submit additional details via their national authority |
2. Management body duties (Article 20)
NIS2 makes cybersecurity a management responsibility. Under Article 20(1), the management body must approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements of Article 21. Under Article 20(2), its members must follow training, and entities are encouraged to offer similar training to employees regularly.
- A board or management decision approving your Article 21 measures, with a date.
- A reporting line so management actually oversees implementation (for example a quarterly security report).
- Records of the training management body members have followed.
3. The ten minimum measures (Article 21)
Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, taking into account the state of the art, relevant European and international standards and the cost of implementation. Proportionality depends on your exposure to risk, your size, and the likelihood and severity of incidents. Article 21(2) lists ten areas the measures must include at least. The "what to have" column describes what that usually means in practice; your national law or, for digital providers, Implementing Regulation (EU) 2024/2690 may be more specific.
| Measure | Article | What to have in practice |
|---|---|---|
| Risk analysis and information system security policies | 21(2)(a) | A documented risk assessment of your network and information systems, reviewed regularly, and an approved information security policy |
| Incident handling | 21(2)(b) | A written process to detect, triage, contain and recover from incidents, with named roles |
| Business continuity and crisis management | 21(2)(c) | Backups that are tested by restoring them, a disaster recovery plan, and a crisis management procedure |
| Supply chain security | 21(2)(d), 21(3) | A list of direct suppliers and service providers, security requirements in contracts, and an assessment of each critical supplier's vulnerabilities and practices |
| Security in acquisition, development and maintenance | 21(2)(e) | Security requirements when buying or building systems, patching, and a vulnerability handling and disclosure process |
| Assessing the effectiveness of the measures | 21(2)(f) | Periodic checks that controls work: internal reviews, audits, tests, metrics |
| Basic cyber hygiene and cybersecurity training | 21(2)(g) | Baseline hygiene rules (updates, passwords, phishing) and training for all staff |
| Cryptography and, where appropriate, encryption | 21(2)(h) | A policy on when data is encrypted at rest and in transit and how keys are managed |
| Human resources security, access control and asset management | 21(2)(i) | Joiner, mover and leaver steps, least-privilege access with regular reviews, and an asset inventory |
| Multi-factor authentication and secured communications | 21(2)(j) | Multi-factor or continuous authentication, and secured voice, video, text and emergency communications, where appropriate |
Check where you stand: the free NIS2 Readiness Check scores you across nine security domains built on Article 21, with practical next steps.
Supply chain: what Article 21(3) adds
When deciding which supply chain measures are appropriate, you must take into account the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, including secure development, and the results of EU-level coordinated risk assessments of critical supply chains. In practice that means a documented assessment per critical supplier, not just a contract clause. Our Vendor Risk Assessment tool gives you a structured starting point.
Gaps you find yourself
Under Article 21(4), an entity that finds it does not comply with the Article 21(2) measures must take all necessary, appropriate and proportionate corrective measures without undue delay. Keep a remediation log with owners and dates, so your gap assessment turns into a plan.
4. Incident reporting readiness (Article 23)
Significant incidents must be reported to your CSIRT or competent authority in stages counted from when you become aware of them: an early warning within 24 hours, an incident notification within 72 hours, an intermediate report on request, and a final report within one month of the notification. Before an incident happens, have:
- The contact details and reporting channel of your CSIRT or authority.
- Criteria for deciding whether an incident is significant (Article 23(3): severe operational disruption or financial loss for you, or considerable damage to others).
- Pre-filled templates for the early warning and the notification.
- A rule for when and how you inform recipients of your services (Article 23(1) and (2)).
Our NIS2 incident reporting guide walks through each report.
5. Evidence and certification
- Keep the documents behind every item above: approvals, policies, risk assessments, test results, training records and supplier assessments. Authorities can inspect and audit essential entities proactively, including random checks (Article 32), and act on important entities when there is evidence or indication of non-compliance (Article 33).
- Check whether your country requires certified ICT products, services or processes for particular Article 21 requirements. Article 24 lets member states require certification under European schemes.
- Digital infrastructure and digital service providers should work from the technical requirements in Implementing Regulation (EU) 2024/2690, which details these measures for them.
Turn this checklist into a working gap assessment. The NIS2 Compliance Starter Kit includes a gap-assessment workbook, an incident response plan template, a supply chain security policy template and a board briefing deck, as editable Office files.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 20, 21, 23, 24, 27, 32 and 33, EUR-Lex
- Commission Implementing Regulation (EU) 2024/2690: technical and methodological requirements for digital providers, EUR-Lex
Related tools
Further reading: What Is the NIS2 Directive? · NIS2 Incident Reporting
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.