Knowledge · NIS2 · Article 21
Ten areas of measures, proportionate to your risk.
Essential and important entities must take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems – with an all-hazards approach.
What it requires
In plain words.
- Policies on risk analysis and information system security
- Incident handling
- Business continuity – backups, disaster recovery and crisis management
- Supply chain security, including your direct suppliers
- Security in acquisition, development and maintenance, including vulnerability handling
- Policies to assess how effective the measures are
- Basic cyber hygiene and cybersecurity training
- Cryptography and, where relevant, encryption
- Human resources security, access control and asset management
- Multi-factor authentication and secured communications
Plain-language summary of NIS2 Article 21 (Directive (EU) 2022/2555). Not legal advice – read the official text on EUR-Lex.
In practice
What it takes.
Most organisations have parts of this already. The work is to show which measure covers which point, who owns it, and that it is followed up – including in your supplier contracts.
- ControlsThe ten areas as Controls, each with an owner
- Supplier reviewsA risk-based review flow for direct suppliers
- Contract requirementsSecurity terms checked in the agreements you have signed
- EvidenceCollected where the work happens, not before the audit
How it runs in Paragraf – on the same foundation as your contracts and processes.
Next step
See NIS2 article 21
with your own requirements.
Book a walkthrough. We show you the thread from this article to the Control, the owner and the evidence – in your own setup.