Cybersecurity

NIS2: Article 21 measures, incident reporting and management body obligations

The ten measures of Article 21.2(a)-(j), each with an owner, a review date and linked evidence.

Let's talkNIS2 check: does it apply?

The NIS2 Directive requires essential and important entities to adopt cybersecurity risk-management measures, report significant incidents and hold management bodies accountable. Each Member State transposes it into national law and designates a competent authority; in Italy this is Legislative Decree 138/2024 and the National Cybersecurity Agency (ACN). Declaring the measures is not enough: they must be backed by evidence.

Who it applies to

  • Entities in the sectors of Annexes I and II (energy, transport, health, digital infrastructure, ICT services, manufacturing and more), generally medium and large companies.
  • Some entities regardless of size, such as DNS service providers and designated public administrations.
  • Entities registered with, or notified by, the national competent authority.

The problem

01

The authority can ask for evidence of the measures

Besides the written policy, proof of its application is needed: who applies it and since when.

02

Management body accountability (Art. 20)

The management body approves the measures, oversees their implementation and undergoes dedicated training.

03

Incident reporting timelines (Art. 23)

Early warning within 24 hours, notification within 72 hours, final report within one month. Classification criteria and roles need to be defined before an incident occurs.

What it requires

  1. 01

    Risk management

    Risk analysis and information system security policies, with periodic assessment of the effectiveness of the measures.

  2. 02

    Incidents and continuity

    Incident handling, business continuity, backup, recovery and crisis management.

  3. 03

    Supply chain

    Security in relationships with direct suppliers and service providers, including their vulnerability handling.

  4. 04

    Access and cryptography

    Access control, asset management, multi-factor authentication, cryptography and secured communications.

  5. 05

    Training and cyber hygiene

    Basic cyber hygiene practices and training, including for members of management bodies.

  6. 06

    Incident reporting

    Early warning within 24 hours, notification within 72 hours and a final report within one month for significant incidents.

Timeline

  1. 16 Jan 2023Directive enters into force.
  2. 17 Oct 2024Deadline for transposition into national law.
  3. 2025–2026Registration of entities and phased application of measures, depending on each country.

Deadlines and detailed measures depend on national law and on the competent authority: they should be checked for each country and case.

EVIDEVO

How EVIDEVO manages controls and evidence for NIS2

Measures linked to controls

In Controls and compliance, the Article 21.2(a)-(j) measures and the Article 23 reporting obligations are linked to controls, to be tailored to the entity's scope.

Owner and review for every measure

Each measure has an owner, a review date and a status, recorded with the history of changes.

Evidence with a validity date

Minutes, reports and policies are linked to the requirement and have a validity date; an alert is generated before expiry.

Management body reporting

The status of the measures is summarised in a report for the management body, which approves the measures and oversees their implementation (Art. 20).

Data for illustrative purposes only, not real

What can be exported

  • List of measures with status, owner and linked evidence
  • Log of reviews and changes
  • Evidence package by period

Capabilities for NIS2

How to determine whether NIS2 applies

Sector, size and services define the scope. The starting assessment identifies it and sets the priorities.

Starting assessment

Guides on NIS2

Frameworks that share evidence

Informational summary, updated October 2026. Not legal advice: applicability and obligations should be checked against the official text and the specific case.

A thirty-minute presentation based on the organisation's scope.

It starts from the frameworks in scope and how the work is organised today. In thirty minutes, EVIDEVO is shown working in that context.

Let's talk