The 10 NIS2 Minimum Security Measures (Article 21) Explained

The 10 Article 21(2) Categories

1. Risk analysis and information system security policies
2. Incident handling
3. Business continuity — backup management, disaster recovery, and crisis management
4. Supply chain security — including relationships with direct suppliers and service providers
5. Security in network and information systems acquisition, development and maintenance — including vulnerability handling and disclosure
6. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
7. Basic cyber hygiene practices and cybersecurity training
8. Cryptography — policies and procedures on cryptography and, where appropriate, encryption
9. Human resources security, access control policies and asset management
10. Multi-factor / continuous authentication and secured communications (voice, video, text) and secured emergency communications, where appropriate

Appropriate and Proportionate

Measures must reflect risk exposure, entity size, likelihood and severity of incidents, and societal/economic impact. National authorities and implementing acts (where applicable to certain digital providers) may add detail — the Directive categories remain the floor.

Evidence Themes Supervisors Expect

• Approved policies mapped to each category
• Operational proof (logs, tests, supplier assessments, MFA coverage)
• Management-body oversight artefacts under Article 20

How CyberSilo Helps

• Article 21 evidence map and gap tracking in CSA for NIS2
• Article 23 reporting clocks with ThreatHawk SIEM detection workflows
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

How many Article 21 measures are there?

Ten. Article 21(2) of Directive (EU) 2022/2555 lists 10 minimum cybersecurity risk-management measure categories.

Do important entities get a shorter list?

No. The 10 categories apply to essential and important entities; proportionality and supervision intensity differ.

Is ISO 27001 enough to cover Article 21?

ISO 27001 helps a lot but does not automatically prove NIS2 compliance — map Annex A controls explicitly and close Directive-specific gaps (reporting clocks, management liability, sector rules).

Related NIS2 Resources

NIS2 hub · Supply chain · Logging · CSA