{
  "id": "nis2-measures",
  "title": "NIS2 minimum cybersecurity risk-management measures (Article 21(2))",
  "description": "The ten measures every essential and important entity must include, plus the related governance and reporting duties.",
  "verified": "2026-10-19",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "attribution": "ClevSec (https://clevsec.one)",
  "disclaimer": "For informational purposes only; not legal advice. Check the cited sources and your national law.",
  "human_readable": "https://clevsec.one/blog/nis2-compliance-checklist/?ref=agent",
  "sources": [
    "https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng",
    "https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng"
  ],
  "items": [
    {
      "point": "21(2)(a)",
      "measure": "Policies on risk analysis and information system security"
    },
    {
      "point": "21(2)(b)",
      "measure": "Incident handling"
    },
    {
      "point": "21(2)(c)",
      "measure": "Business continuity, such as backup management and disaster recovery, and crisis management"
    },
    {
      "point": "21(2)(d)",
      "measure": "Supply chain security, including security-related aspects of relationships with direct suppliers or service providers"
    },
    {
      "point": "21(2)(e)",
      "measure": "Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure"
    },
    {
      "point": "21(2)(f)",
      "measure": "Policies and procedures to assess the effectiveness of cybersecurity risk-management measures"
    },
    {
      "point": "21(2)(g)",
      "measure": "Basic cyber hygiene practices and cybersecurity training"
    },
    {
      "point": "21(2)(h)",
      "measure": "Policies and procedures regarding the use of cryptography and, where appropriate, encryption"
    },
    {
      "point": "21(2)(i)",
      "measure": "Human resources security, access control policies and asset management"
    },
    {
      "point": "21(2)(j)",
      "measure": "Multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems, where appropriate"
    }
  ],
  "related_duties": [
    {
      "duty": "Management body approves and oversees the measures, can be held liable, and follows training",
      "reference": "Art. 20"
    },
    {
      "duty": "Measures appropriate and proportionate, considering state of the art, standards and cost",
      "reference": "Art. 21(1)"
    },
    {
      "duty": "Corrective measures without undue delay when non-compliance is found",
      "reference": "Art. 21(4)"
    },
    {
      "duty": "Report significant incidents (24 h / 72 h / one month)",
      "reference": "Art. 23"
    },
    {
      "duty": "Technical requirements for digital infrastructure and digital service providers",
      "reference": "Implementing Regulation (EU) 2024/2690, Annex"
    }
  ]
}