Article 21 is the operational core of NIS2. It is the article that decides what an in-scope entity actually has to do, and it is shorter than most people expect: one paragraph of principles, one list of ten measures, and a few paragraphs on supply chains and corrective action.
The brevity is deceptive. Each item in the list names a whole discipline, such as incident handling or business continuity, without saying how much of it is enough. That judgment is left to you, to your national law, and in some cases to further EU rules.
This article goes through the principles, each of the ten measures with the evidence that shows it is in place, the extra detail for certain digital providers, and how an ISO 27001 program maps across.
The principles before the list
Article 21(1) of Directive (EU) 2022/2555 requires essential and important entities to take appropriate and proportionate technical, operational and organizational measures. The measures manage the risks to the network and information systems the entity uses for its operations or services, and prevent or minimize the impact of incidents on recipients of its services and on other services.
Three qualifiers shape how much is enough:
State of the art. Measures take into account the state of the art and, where applicable, relevant European and international standards, as well as the cost of implementation.
Proportionality. Measures are proportionate to the entity's exposure to risks, its size, and the likelihood and severity of incidents, including their societal and economic impact.
All hazards. Article 21(2) states that the measures are based on an all-hazards approach, aiming to protect systems and their physical environment. Power loss, fire and hardware failure are in scope, not only attackers.
The classification as essential or important, covered in NIS2 essential vs important entities, does not change this list. It changes how you are supervised against it.
The ten measures and the evidence for each
Article 21(2) says the measures shall include at least the following. The evidence suggestions are ours, not the directive's, and reflect what a supervisor or auditor would reasonably ask to see.
Policies on risk analysis and information system security. A documented risk assessment method, a current risk register, and an approved information security policy. Evidence: the policy with approval date, and the most recent risk assessment.
Incident handling. A process to detect, analyze, contain and respond to incidents. Evidence: an incident response plan, incident records, and the link to your reporting procedure under Article 23.
Business continuity, such as backup management and disaster recovery, and crisis management. Evidence: continuity and recovery plans, backup configuration, and restore test results. A backup you have never restored is an assumption; see backup and restore testing.
Supply chain security, including security aspects of the relationships between the entity and its direct suppliers or service providers. Evidence: a supplier inventory with risk ratings, due diligence records, and security terms in contracts. Article 21(3) adds detail, discussed below.
Security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. Evidence: secure development standards, change records, vulnerability scan results with remediation, and a published way for outsiders to report vulnerabilities.
Policies and procedures to assess the effectiveness of cybersecurity risk management measures. Evidence: internal audits, control testing, metrics reviewed by management, and records of what changed as a result. This is the measure most often missing, because it requires checking the other nine.
Basic cyber hygiene practices and cybersecurity training. Evidence: hygiene baselines such as patching, endpoint configuration and password rules, plus training completion records for staff.
Policies and procedures on the use of cryptography and, where appropriate, encryption. Evidence: a cryptography policy naming approved algorithms and key management responsibilities, and configuration showing encryption in transit and at rest where the policy requires it.
Human resources security, access control policies and asset management. Evidence: screening and onboarding steps, joiner, mover and leaver records, access reviews, and an asset inventory.
Multi-factor authentication or continuous authentication, secured voice, video and text communications, and secured emergency communication systems, where appropriate. Evidence: MFA enforcement settings and coverage, and the tools approved for sensitive and emergency communication. For the mechanics, see enforcing MFA for every user.
Note the wording "at least". The list is a minimum. A risk assessment that identifies a significant risk outside these ten still requires a measure.
Supply chain detail in Article 21(3)
When considering supply chain security, Article 21(3) requires entities to take into account the vulnerabilities specific to each direct supplier and service provider. They also consider the overall quality of suppliers' products and cybersecurity practices, including their secure development procedures.
Entities must also take into account the results of coordinated security risk assessments of critical supply chains carried out at EU level under Article 22. Supply chain security is broad enough to need its own program, and it is the measure customers will push hardest onto their vendors.
Extra detail for certain digital providers
Article 21(5) gave the Commission the task of adopting implementing acts with technical and methodological requirements for specific entity types. These include DNS service providers, top-level domain registries, cloud computing service providers, data center service providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers.
The Commission adopted that implementing regulation in October 2024. For those entity types, it turns the ten headings into detailed requirements, and it also specifies when an incident counts as significant. If you are one of those types, read it alongside Article 21. It is the more specific text, and supervisors will use it.
For other entities, national law may add detail, and member states can require the use of particular certified products or services under Article 24. Check your national transposition for both.
Corrective action when you fall short
Article 21(4) requires an entity that finds it is not complying with the measures to take all necessary, appropriate and proportionate corrective measures without undue delay.
This matters because it makes finding a gap a trigger for action, not a private note. Keep a record of each gap you identify, the corrective measure chosen, the owner, and the date it closed. That record is evidence of a working program. An unexplained gap known for a year is evidence of the opposite.
How ISO 27001 maps across
An ISO 27001 management system covers most of Article 21 in substance. Risk assessment and treatment, the Annex A controls, internal audit and management review line up well with measures 1, 2, 3, 5, 6, 7, 8, 9 and 10, and partly with 4.
The gaps are in scope, specificity and governance:
Scope. Your ISMS scope is your choice. NIS2 covers the network and information systems used for your operations or services. Check that every in-scope system is inside the ISMS boundary.
Supply chain. Annex A supplier controls are a start. Article 21(3) asks for assessment per direct supplier and attention to secure development practices.
Implementing rules. For the digital provider types above, the implementing regulation is more specific than Annex A in places.
Management duties. Article 20 requires management bodies to approve the measures, oversee them and follow training. ISO 27001 management review is helpful evidence but not a substitute.
Reporting. ISO 27001 does not contain NIS2's incident reporting stages or deadlines.
Certification is evidence, not a safe harbor. It shows an auditor found your system conforming to ISO 27001. It does not show a supervisor that you meet national NIS2 law. Map the two article by article and record the gaps.
Common mistakes
Writing ten policies and stopping. The measures are operational. A policy without records of operation is half the evidence.
Skipping measure 6. Effectiveness assessment is what turns a set of controls into a program.
Ignoring physical hazards. The all-hazards approach covers your physical environment and utilities.
Reading only the directive. National law, and for some entities the implementing regulation, carry the detail. How those texts apply to you is a point to confirm with counsel.
The NIS2 framework page places Article 21 within the directive's full structure.
How TrustLynce helps
TrustLynce's policy management provides policy templates with versioning and acceptance tracking, so the documented measures carry approval dates. Continuous monitoring checks controls on a schedule and routes failures to owners, which gives you a running record for measure 6 and for Article 21(4) corrective action.