"Comply with the directive" is the instruction a security team is usually handed. In practice, most of what that means lives in a single article. Article 21 is where NIS2 stops being a principle and becomes a list of things you actually have to do - a defined set of cybersecurity risk-management measures, not a vague instruction to be secure.
Understanding those measures is the difference between a NIS2 programme that holds up and one that discovers its gaps during an incident.
There are ten categories of measure, and they are cumulative: an in-scope entity is expected to address all of them, proportionate to the risk it faces.
They fall into four natural groups - understanding the risk, protecting against it, detecting and responding to it, and keeping the measures honest over time. Taken together, they describe a whole risk-management system, which is the point: NIS2 is not asking for a handful of controls, it is asking for a programme.
Understanding the risk
The first measures are about knowing what you are defending and against what.
The first is risk analysis and information-system security policies - the foundation: a documented process for identifying and assessing the risks to your network and information systems, and the security policies that follow from it.
Everything else depends on this, because you cannot protect, detect or respond proportionately if you have not established what the risks actually are.
Supply-chain security. NIS2 treats the security of your suppliers and service providers as your concern, not just theirs.
This is the measure that reaches outward - it requires you to account for the security of the ICT providers your services depend on, which in an AI era increasingly means the AI features and model providers sitting inside the tools you use.
Protecting against it
The next group is the preventive core - the measures that reduce the chance of a successful attack.
Then security in acquisition, development and maintenance, including vulnerability handling and disclosure.
Security has to be built into how you procure and build systems, not bolted on afterwards, and you need a process for handling vulnerabilities as they emerge.
Cryptography and encryption come next: policies on, and where appropriate the use of, cryptography to protect data in transit and at rest.
Then the people-and-permissions layer, human-resources security, access control and asset management: controlling who can reach what, managing the assets that make up the estate, and addressing the security dimension of how staff are managed.
Multi-factor authentication and secure communications round out the preventive group: multi-factor or continuous authentication, secured voice, video and text communications, and secured emergency-communication systems where appropriate.
And basic cyber hygiene and training: foundational cyber-hygiene practices and cybersecurity training for staff.
This is the measure most often underestimated - the baseline practices and awareness that stop the routine attacks, which are most of them.
Detecting and responding
The third group is about what happens when prevention is not enough - because NIS2 assumes it sometimes will not be.
Incident handling is the first of these: a defined capability for detecting, managing and responding to security incidents.
This is the internal operational capability - the ability to actually deal with an incident, and it sits alongside, but is separate from, the Article 23 obligation to report significant incidents to the authorities.
Business continuity and crisis management is the second, including backup management and disaster recovery.
This is the ability to keep operating, or recover quickly, when an incident hits, up-to-date backups, a disaster-recovery plan, and a crisis-management process that works under pressure rather than only on paper.
Keeping the measures honest
The final measure is the one that stops the whole programme from quietly decaying.
The last measure is policies to assess the effectiveness of the measures: NIS2 requires procedures to evaluate whether the risk-management measures are actually working.
This is what distinguishes a living programme from a documented-once-and-forgotten one: you have to check that the controls you implemented are still doing their job, and adjust when they are not. It is the measure that turns the other nine from a snapshot into something maintained.
What the ten add up to
Read as a set, the ten measures are not a checklist to tick and file. They describe a continuous risk-management system: understand your risks, protect against them, detect and respond when protection fails, and keep testing that the whole thing still works.
The proportionality principle runs through all of them - a small important entity is not held to the same depth as a large essential one, but the categories themselves apply across the board.
Two things are worth remembering about how these obligations actually bite. First, they are the management body's responsibility to approve and oversee, not something that can be fully delegated to IT - Article 20 puts the board on the hook for exactly these measures.
Second, they apply to the whole estate, including the parts that arrived without going through a security process - the AI features switched on inside existing tools, for instance. A measure like supply-chain security or access control only covers what the programme knows about, so the scope of the estate the board is signing off for is worth establishing deliberately, not assuming.
Frequently asked questions
What are the NIS2 Article 21 security measures?
Montro's summary: Article 21 requires ten categories of cybersecurity risk-management measure - risk analysis and security policies; incident handling; business continuity and crisis management; supply-chain security; security in acquisition, development and maintenance; policies to assess the measures' effectiveness; cyber hygiene and training; cryptography and encryption; human-resources security, access control and asset management; and multi-factor authentication and secured communications.
They are a mandatory minimum, applied proportionately to the risk the entity faces.
Are the Article 21 measures mandatory?
Yes, for in-scope entities, as a minimum set - but applied proportionately.
NIS2 expects every in-scope entity to address all ten categories, while recognising that the depth required scales with the entity's size and risk: a large essential entity is held to a higher standard than a smaller important one. Proportionality adjusts how much each measure requires, not whether it applies.
Is Article 21 the same as the Article 23 reporting duty?
No. Article 21 is the set of risk-management measures an entity must implement; Article 23 is the separate obligation to report significant incidents to the authorities on a defined timeline.
Article 21 includes an incident-handling measure, the internal ability to manage incidents - but the external reporting duty is a different obligation under Article 23.
Who is responsible for the Article 21 measures?
Ultimately the management body. Under Article 20, the board must approve the Article 21 risk-management measures and oversee their implementation, and can be held accountable for failures.
So while the measures are implemented operationally, responsibility for them sits at the top - they are not something a board can treat as purely an IT matter delegated downward.
