NIS2 Art. 21(2): the ten minimum risk-management measures, letter by letter
What each of letters (a) to (j) of Article 21(2) of the NIS2 Directive requires, and what evidence organisations typically keep to demonstrate it. Includes the proportionality principles of Article 21(1) and the management body duties set out in Article 20.
The regulatory framework
Directive (EU) 2022/2555 (NIS2) requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of the network and information systems they use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.
Article 21(2) lists the minimum measures, from letter (a) to letter (j). The measures are based on an all-hazards approach: they must protect network and information systems and also their physical environment.
In Italy the Directive is transposed by Legislative Decree 138/2024. The National Cybersecurity Agency (ACN) is the NIS competent authority and sets out the implementing specifications and related timelines in its own measures, which should be read in their current version.
Proportionality: what Article 21(1) says
The measures must take into account the state of the art, relevant European and international standards where applicable, and the cost of implementation. They must be proportionate to the entity's exposure to risks, its size, the likelihood of incidents and their severity, including their societal and economic impact.
Proportionality concerns how a measure is implemented, not whether it is implemented. Each letter of Article 21(2) remains an obligation; a 60-person organisation and a large operator may meet it with different tools and levels of formality. The choice should be justified in the risk analysis, because the risk analysis is what the authority examines to assess adequacy.
The ten measures and typical evidence
The "Measure" column summarises the text of the Directive. The "Typical evidence" column lists the documents and records organisations usually keep: it is not an official list and does not replace national specifications.
| Letter | Measure | Typical evidence |
|---|---|---|
| (a) | Policies on risk analysis and information system security | Approved security policy; risk methodology and risk register; treatment plan with owners; date of last review |
| (b) | Incident handling | Procedure with roles and classification criteria; incident register; post-incident reports; exercise records |
| (c) | Business continuity (such as backup management and disaster recovery) and crisis management | Business impact analysis; continuity and disaster recovery plans; backup logs; restore test records; crisis exercises |
| (d) | Supply chain security, including security aspects of relationships with direct suppliers and service providers | Vendor list with criticality level; security assessments; contractual clauses; certifications or attestations received |
| (e) | Security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure | Security requirements in procurement; secure development procedure; vulnerability scan reports with remediation times; vulnerability disclosure policy |
| (f) | Policies and procedures to assess the effectiveness of risk-management measures | Internal audit and test plan; control test results; indicators; review minutes; corrective action register |
| (g) | Basic cyber hygiene practices and cybersecurity training | Training programme; attendance records; phishing simulation results; configuration and patching standards |
| (h) | Policies and procedures on the use of cryptography and, where appropriate, encryption | Cryptography policy; inventory of keys and certificates; encryption configuration at rest and in transit; certificate expiry management |
| (i) | Human resources security, access control policies and asset management | Joiner, mover and leaver procedures; periodic access reviews; asset inventory with owners |
| (j) | Where appropriate, multi-factor or continuous authentication, secured voice, video and text communications and secured emergency communication systems | MFA configuration and per-user coverage export; justified list of exceptions; secured communication tools; documented emergency channel |
Reading notes
- Letter (d): read it together with Article 21(3), which requires entities to consider the vulnerabilities specific to each direct supplier, the overall quality of its products and its cybersecurity practices, including secure development procedures.
- Letter (f): the Directive requires the effectiveness of measures to be assessed, not only their adoption. This calls for planned tests with documented results.
- Letters (h) and (j): the words "where appropriate" do not make the measure optional. They require a justified decision on where to apply it, which should be documented.
- Several letters may be covered by the same control: periodic access reviews contribute to letter (i) and, where they cover vendor access, to letter (d).
Article 20: management body duties
Article 20 requires management bodies to approve the risk-management measures taken to comply with Article 21, oversee their implementation and be liable for infringements. Members of management bodies are required to follow training; the Directive also encourages entities to offer similar training to their employees on a regular basis.
Typical evidence: resolution or minutes approving the measures; periodic reports to the management body on implementation status, with the decisions taken; training records for management body members.
Corrective action: Article 21(4)
Where an entity finds that it does not comply with the measures in Article 21(2), it must take all necessary, appropriate and proportionate corrective measures without undue delay. In practice this calls for a corrective action register with owner, deadline and verification of closure.
In EVIDEVO
In Controls and compliance each letter of Article 21(2) is a requirement linked to one or more controls. Each control has an owner, a periodic test and the evidence that demonstrates it, with a validity date; a failed test raises a corrective action with an owner and a deadline.
Official sources
Informational summary. Not legal advice: obligations and applicability should be checked against the official texts and the specific case.