NIS2 Article 21: The 10 Cybersecurity Risk-Management Measures Explained

The measures exist to manage the risks to network and information systems and to prevent or minimise the impact of incidents on the recipients of an entity's services.

The 10 points rest on an all-hazards approach that also protects the physical environment of those systems. For the 11 entity types of Implementing Regulation (EU) 2024/2690, such as cloud computing service providers and managed service providers, a Commission act breaks every letter down into numbered requirements. Directive (EU) 2022/2555 sets the measures beside the management duties of Article 20 and the reporting duties of Article 23, and how the measures fit into the rest of the NIS2 Directive is set out on the home page.

This page reads Article 21 paragraph by paragraph: the general test of paragraph 1, the 10 letters with their Annex section, the supplier factors, corrective action and the implementing acts. It then compares the German and French wording and closes with the status as of 23 October 2026.

What Does Article 21 of NIS2 Require?

Article 21 of Directive (EU) 2022/2555 has five paragraphs: a general duty to take appropriate and proportionate measures (21(1)), a floor of 10 measures (21(2)), supplier factors (21(3)), corrective action (21(4)) and Commission implementing acts (21(5)). The Directive text on EUR-Lex states the purpose in paragraph 1: the measures manage the risks posed to the security of network and information systems and prevent or minimise the impact of incidents on recipients of services and on other services.

Proportionality is measured by four factors in Article 21(1): the entity's degree of exposure to risks, its size, the likelihood of incidents and their severity, including their societal and economic impact. The security level takes into account three inputs: the state of the art, relevant European and international standards where applicable, and the cost of implementation. Neither the Directive nor Implementing Regulation (EU) 2024/2690 defines "state of the art"; the Directive asks entities to take it "into account".

The all-hazards approach of Article 21(2) covers the physical environment of the systems, and recital 79 gives five examples: theft, fire, flood, telecommunication or power failures, and unauthorised physical access. The duty itself is not new: Annex III of the Directive correlates Articles 14(1) and (2) and 16(1) and (2) of the NIS1 Directive (EU) 2016/1148 with Article 21(1) to (4). The table below sets out what each of the five paragraphs says.

Who Applies the Measures and Under Which Law?

Essential and important entities apply the measures, and they are bound by the national law that transposes Article 21, because the Directive is addressed to Member States (Article 46). Both categories carry the same Article 21 duties. The two categories differ in supervision: essential entities face ex ante and ex post supervision under Article 32, important entities ex post supervision only under Article 33.

Member States may adopt or maintain provisions that ensure a higher level of cybersecurity (Article 5), so the national list can be stricter than the Directive. Recital 83 adds that the measures cover network and information systems whether the entity maintains them internally or outsources them. The size and sector rules that decide which organisations count are explained under who NIS2 applies to.

The 10 Minimum Measures of Article 21(2)

Article 21(2) lists 10 minimum measures, points (a) to (j), that every essential and important entity includes in its cybersecurity risk-management measures: risk analysis and security policies, incident handling, business continuity, supply chain security, secure acquisition and development, effectiveness assessment, cyber hygiene and training, cryptography, human resources security with access control and asset management, and multi-factor authentication with secured communications. Table 1 gives the official wording of each letter, the Annex section of Implementing Regulation (EU) 2024/2690 that details it, and the page that explains it.

Why the List Is a Floor, Not a Complete Catalogue

The 10 points are a floor, because Article 21(2) says the measures "shall include at least" them on an all-hazards basis. The risk analysis under point (a) decides what else an entity needs: a measure outside the 10 letters becomes part of the duty when the Article 21(1) test of exposure, size, likelihood and severity calls for it. The list is therefore neither a closed set of 10 controls nor a copy of a standard's control catalogue.

The management body carries the result. Under Article 20(1) of the Directive, management bodies of essential and important entities approve the cybersecurity risk-management measures taken under Article 21, oversee their implementation and can be held liable for infringements. The approval, oversight and training duties of the board are explained under NIS2 Article 20 management duties.

The Point-by-Point Detail Behind Each Letter

For the 11 entity types of Implementing Regulation (EU) 2024/2690, each letter of Article 21(2) is broken down into numbered requirements in the Annex of that Regulation, whose 13 sections follow the order of points (a) to (j). Column 3 of Table 1 shows the mapping: sections 1 and 2 detail point (a), sections 10, 11 and 12 detail point (i), and section 7 on effectiveness draws on points 2.2, 2.3 and 6.5. Section 13 is the only section headed with three letters, "Article 21(2), points (c), (e) and (i)", and splits into supporting utilities (13.1), physical and environmental threats (13.2) and perimeter and physical access control (13.3).

The Regulation itself has 43 recitals, 16 articles and one Annex, and the Annex binds nobody outside the 11 entity types. What applies to every other essential and important entity is explained in the Article 21(5) section below.

Measures Qualified by "Where Appropriate"

Three measures carry the qualifier "where appropriate": encryption under point (h), and multi-factor or continuous authentication and secured communications under point (j). Cryptography itself is not optional, since point (h) always requires policies and procedures on the use of cryptography and limits only encryption to cases where it is appropriate. For the 11 entity types of Implementing Regulation (EU) 2024/2690, Annex point 11.7.1 asks for users authenticated by multiple factors or continuous authentication "where appropriate, in accordance with the classification of the asset", so multi-factor authentication is not mandatory for every account.

The qualifier does not make a requirement optional. Article 2(2) of the Regulation states that where the Annex uses "where appropriate", "where applicable" or "to the extent feasible", an entity that does not apply the requirement documents its reasoning "in a comprehensible manner". Recording these decisions is one step of the NIS2 compliance requirements an entity follows end to end.

Supplier Vulnerabilities and Union Risk Assessments: Article 21(3)

Article 21(3) requires an entity choosing measures under point (d) to take into account the vulnerabilities specific to each direct supplier and service provider, the overall quality of their products and cybersecurity practices, including secure development, and the results of the coordinated risk assessments under Article 22(1). All three factors feed the choice of point (d) measures, alongside the Article 21(1) test.

The coordinated risk assessments come from the EU level. Under Article 22(1), the Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products supply chains, taking into account technical and, where relevant, non-technical risk factors. The first two such assessments, on connected and automated vehicles and on detection equipment at border crossings, were adopted on 13 February 2026, according to the Commission announcement. Their results now count among the factors an entity takes into account under Article 21(3).

The scope of the paragraph is the direct supplier or service provider. Recital 85 leaves further tiers of the supply chain to the entity's choice, and recital 86 asks for increased diligence when an entity selects a managed security service provider. Suppliers are not directly obliged by the Directive: the entity reaches them through its contracts and its point (d) measures.

Corrective Action Without Undue Delay: Article 21(4)

Article 21(4) requires an entity that finds it does not comply with Article 21(2) to take all necessary, appropriate and proportionate corrective measures without undue delay. The Directive sets no number of days for this correction. The duty is triggered by the entity's own finding that it does not comply.

Infringements of Article 21 fall under the fine maximums of Article 34, which Member States must at least provide. Under Article 34(4), essential entities face a maximum of at least EUR 10,000,000 or at least 2 % of total worldwide annual turnover, whichever is higher; under Article 34(5), important entities face a maximum of at least EUR 7,000,000 or at least 1.4 %, whichever is higher. How Member States apply the NIS2 fines is set out on its own page.

Binding Detail for 11 Digital Entity Types: Article 21(5)

Article 21(5) required the Commission to adopt implementing acts by 17 October 2024 for 11 digital entity types, and it did so with Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, in force and directly applicable since 7 November 2024. The Regulation text on EUR-Lex (CELEX 32024R2690, OJ L, 2024/2690, 18.10.2024) is based on Article 21(5), first subparagraph, and Article 23(11), second subparagraph, of the Directive. Article 15 repeals Implementing Regulation (EU) 2018/151.

The 11 entity types of Article 1 of the Regulation are listed below.

• DNS service providers
• TLD name registries
• Cloud computing service providers
• Data centre service providers
• Content delivery network providers
• Managed service providers
• Managed security service providers
• Providers of online marketplaces
• Providers of online search engines
• Providers of social networking services platforms
• Trust service providers

For all other essential and important entities, Article 21(5), second subparagraph, says the Commission "may" adopt implementing acts with technical, methodological and sectoral requirements. No such act has been adopted as of 23 October 2026, so a manufacturer, an energy operator or a hospital follows the list in its national law.

How Transposing Acts Reword the Ten Measures

The transposing acts keep the 10 points of Article 21(2), but the two compared here word the duty differently: Germany's BSIG 2025 lists the 10 measures in § 30(2) with stricter wording, and France's agency exempts the digital entity types from its national baseline. Both differences matter for an entity that reads only the Directive text.

Germany sets the measures in § 30 BSIG, part of the BSIG 2025 enacted as Article 1 of the NIS2UmsuCG (BGBl. 2025 I Nr. 301), which applies since 6 December 2025. § 30(2) lists the 10 minimum measures, and § 30(1) names three protection goals, availability, integrity and confidentiality, and obliges entities to document their compliance. The German text says "technical and organisational" measures where the Directive says "technical, operational and organisational".

The wording on the state of the art is stricter in Germany. § 30(2) BSIG says the measures "sollen den Stand der Technik einhalten" (should comply with the state of the art), while Article 21(1) only asks entities to take the state of the art into account. § 30(3) gives Implementing Regulation (EU) 2024/2690 precedence for the 11 entity types it covers. The full German law is covered under NIS2 in Germany.

France takes a different route. ANSSI states on its MesServicesCyber NIS 2 page that entities subject to Implementing Regulation (EU) 2024/2690 are not subject to the French national security baseline, ReCyF. ReCyF version 2.5 is an ANSSI working document, and its objectives 16 to 20 apply to essential entities only.

Evidence and Non-Binding Guidance for the Measures

ENISA's Technical Implementation Guidance version 1.0 of 26 June 2025 is the main non-binding companion to the measures: for each requirement of the Annex it gives guidance, examples of evidence and tips. The ENISA guidance runs to about 170 pages (ISBN 978-92-9204-704-7, doi:10.2824/2702548) and follows the Annex of Implementing Regulation (EU) 2024/2690 point by point. ENISA states that applying the guidance "does not assume compliance", so an entity still demonstrates each requirement under its national law.

The evidence examples are most useful in the order of the Annex. An entity outside the 11 entity types can consult them for its national list, because the Annex follows the order of points (a) to (j). Version 1.2 of the ENISA mapping table maps each Annex point to ISO/IEC 27001:2022, NIST CSF 2.0, ETSI EN 319 401, CEN/TS 18026:2024 and national frameworks. The mapping is advisory and does not turn any of these standards into a legal requirement.

Article 21 Status on 2026-10-23

As of 23 October 2026, Member States have been required to apply their transposing measures since 18 October 2024 (Article 41(1)), Implementing Regulation (EU) 2024/2690 has applied directly to its 11 entity types since 7 November 2024, and no implementing act for other entities exists. The Directive itself has been in force since 16 January 2023 (Article 45).

One proposal would change the paragraph around the measures, not the measures themselves. The Commission proposed COM(2026) 13 (procedure 2026/0012(COD)) on 20 January 2026, and as of 23 October 2026 it is pending: the European Parliament procedure file shows the stage "Awaiting committee decision", with ITRE amendments tabled on 13 October 2026. The proposal does not amend points (a) to (j), and its progress is tracked under NIS2 amendments and review.

Three changes in the proposal text relate to the measures. Where Article 21(5) implementing acts exist, Member States would no longer be allowed to impose further technical, methodological or sectoral requirements, a move to maximum harmonisation for the 11 entity types. The Commission would develop guidelines on the level of detail, structure and format of supply-chain information requests. A cyber posture certificate would, for the requirements it covers, remove additional security audits under Articles 32(2)(b) and 33(2)(b).

What Article 21 Does Not Cover

Article 21 sets the security measures themselves; incident notification, certification and fixed technical deadlines sit elsewhere in the Directive or are not set at all. Three questions follow from that border.

Is Reporting to the CSIRT Part of Article 21?

No: reporting significant incidents is Article 23, with an early warning within 24 hours, an incident notification within 72 hours and a final report not later than one month after the incident notification. The three reports go to the CSIRT or, where applicable, the competent authority, and they are explained under NIS2 incident reporting.

Point (b) of Article 21(2), incident handling, is the internal measure that prepares those reports, and section 3 of the Annex of Implementing Regulation (EU) 2024/2690 details it for the 11 entity types. ENISA is not a recipient of the entity's reports.

Is a Certified ISMS Enough to Meet Article 21?

No certificate proves Article 21 compliance, because no EU-wide NIS2 certificate for organisations exists and the Directive stays technology-neutral (Article 25(1)). Article 24(1) only lets Member States require certified ICT products, ICT services and ICT processes under European cybersecurity certification schemes.

An ISO/IEC 27001 certificate covers a management system, and recital 79 names the ISO/IEC 27000 series among the standards entities may use. The ENISA mapping links the Annex to ISO/IEC 27001:2022 as advice, and the overlaps are compared under NIS2 vs ISO/IEC 27001.

Does Article 21 Set Patch or Log Retention Deadlines?

No: the Annex asks for patches "within a reasonable time" (6.6.1(a)), critical vulnerabilities "without undue delay" (6.10.2(c)) and logs kept for a "predefined period" (3.2.5), and sets no number of days. A documented derogation from patching is possible under point 6.6.2.