After reading, you can go through the directive's measures line by line and record the gap, the owner and the proof.
Definition
Article 21(2) lists ten measures in points (a) to (j): risk analysis and security policies; incident handling; business continuity with backups and crisis management; supply chain security; security in acquisition, development and maintenance, including vulnerability handling; assessment of effectiveness; cyber hygiene and training; cryptography; human resources security, access control and asset management; and multi-factor authentication with secured communications.
Why it matters
A long legal text becomes items you can assign, check and show to an authority.
Each item still calls for judgement. Article 21(1) ties the measures to the company's exposure, its size and the severity of possible incidents, so the same line can mean different work for two companies.
How it works
Confirm the status of the entity under national law. Have the management body approve the measures and schedule its training.
Go through the ten measures. For each one, note what exists, what proves it, what is missing, who is responsible and by when.
Prepare reporting last: criteria for a significant incident, an on-call person, the CSIRT or authority contact, and drafted messages for the 24-hour, 72-hour and one-month steps.
A worked case
Point (d), supply chain. The company counts 12 critical suppliers. Seven contracts include security clauses, and three suppliers were assessed in the last 12 months.
That leaves five contracts and nine assessments to do. The purchasing manager takes this on, for the end of the third quarter. The supplier list and the signed clauses will serve as evidence, and for now the line reads “partly in place”.
Good practices
- Keep the directive's wording next to your own explanation, so that a reviewer can check the reading.
- Add the requirements of your national law as extra lines.
- Ask for one piece of evidence per line.
- Run a reporting exercise and time it from the first alert.
Common mistakes
- Ticking a line because a policy exists. The authority will ask what happens in practice.
- Forgetting Article 20, since a checklist built by IT tends to stop at technical measures.
- Leaving out registration with the authority, which sits outside Article 21 and is easy to miss.
- Starting the 24-hour clock when the investigation ends. It runs from the moment you become aware of the incident.
Questions
- How many measures does Article 21 list?
- Ten, in points (a) to (j) of its second paragraph.
- Is multi-factor authentication mandatory under NIS2?
- Article 21(2)(j) names multi-factor or continuous authentication solutions, where appropriate.
- What are the three NIS2 reporting deadlines?
- An early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report within one month after the notification.
- Must directors follow NIS2 training?
- Yes. Article 20(2) requires members of management bodies to follow training and encourages entities to offer it to staff.
- Are there more detailed rules for digital providers?
- Yes. Implementing Regulation (EU) 2024/2690 sets technical requirements for certain digital providers, such as cloud and managed service providers.