NIS2 Art. 21 — the 10 cybersecurity measures every mid-sized company should know
Article 21 of the NIS-2 directive (EU 2022/2555) obliges essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage cyber risk. The directive itself names ten categories of measures, to be implemented in line with each entity's size, sector and risk exposure. The following overview cites those ten categories verbatim from the Official Journal and pairs each one with the typical gaps we observe in audits of mid-sized manufacturing and OT environments. This page is not a substitute for legal review.1. Risk analysis and information system security
A binding, regularly updated methodology for assessing risks to the entity's network and information systems. BSI IT-Grundschutz and ISO 27005 are well-established frameworks. The directive does not prescribe a specific tool; it requires a documented, traceable approach with an owner and a review cycle. Common gap: a risk analysis is created once, then never updated, or it lives only in a slide deck with no owner or date.
2. Incident handling
Detection, containment, analysis and post-incident review as one continuous process. Article 23 of the NIS-2 directive requires essential and important entities to submit an early warning within 24 hours of becoming aware of a significant incident, followed by an incident notification and a final report. In Germany, the competent authority is the BSI. Common gap: no defined incident response team, no escalation paths, no escalation to management, no notification workflow to the regulator.
3. Business continuity, including backup and disaster recovery
Backup management, disaster recovery and crisis management as one integrated whole. The measure requires defined RTO and RPO values, regularly tested restoration, and an emergency plan that also covers cloud or supplier outages. Common gap: backups exist but have never been tested in a real restore; the emergency plan is three years old and nobody knows where to find it.
4. Supply chain security
Assessment of the cybersecurity practices of each direct supplier and service provider, including their secure development procedures. Article 21(3) of NIS-2 explicitly requires entities to consider the specific vulnerabilities of each supplier and the overall quality of their products and cybersecurity practices. The results of coordinated EU supply-chain risk assessments under Article 22 are also relevant. Common gap: SaaS suppliers are committed contractually but never audited; a central supplier register does not exist.
5. Security in acquisition, development and maintenance of network and information systems
Protective measures across the full lifecycle of ICT systems, including vulnerability handling and disclosure. For in-house development this includes a secure development lifecycle, code reviews, static and dynamic analysis (SAST/DAST), and dependency management. Common gap: no formal SDLC, no mandatory reviews, open-source dependencies not checked against CVE status, no coordinated vulnerability disclosure process.
6. Effectiveness assessment of cybersecurity risk-management measures
Regular, documented review of whether the implemented measures actually work. NIS-2 does not prescribe a specific frequency, but supervisors expect a traceable audit cycle. Independent penetration tests at least annually, combined with internal effectiveness audits, have proven themselves. Common gap: no independent review; self-audits with no external perspective; identical tests in the same scope year after year.
7. Basic cyber hygiene practices and cybersecurity training
Foundational security practices for all staff plus training that addresses cybersecurity risks. Article 20 of NIS-2 additionally obliges members of the management bodies of essential and important entities to follow specific training. Common gap: a one-off mandatory session at hiring, no phishing simulations, no measurement of click rates, no refresher format.
8. Cryptography and encryption
Policies and procedures on the use of cryptography, including encryption where appropriate. Minimum standard: TLS for every external and internal communication, disk and database encryption for data at rest, documented key management with HSM or KMS integration. Common gap: TLS only enforced externally, cleartext internally; keys live in code repositories; no rotation concept.
9. Human resources security, access control policies and asset management
Three connected obligations from Art. 21(2)(i): personnel security (background checks, separation of duties, joiner-mover-leaver processes), access control policy (least privilege, just-in-time), and asset management (complete inventory of all information-processing assets, including OT components). Common gap: MFA not enforced across the board; no joiner-mover-leaver process; OT inventory only in the heads of maintenance.
10. Secured voice, video and text communications and emergency communication systems
Use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications, and secured emergency communication systems within the entity, where appropriate. External communication with critical operators and authorities should also be end-to-end encrypted. Common gap: MFA only on the administrative VPN, not at the OT access layer; business-critical chats run on unapproved messengers without policy.
Frequently asked questions about Art. 21.
Verwandte Seiten