Article 21 lists the minimum measures every entity in scope must have, from risk analysis to encryption and access control. The list is technology neutral. It describes outcomes such as incident handling, business continuity and secure development rather than specific products.
Why it matters
For NIS2, risk measures is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Run and document a risk analysis for your network and information systems
- Cover incident handling, continuity, supply chain and access control
- Review the measures when the threat picture or the business changes
Where to start
Map each measure to an owner, a control and a piece of evidence. Gaps become visible quickly once the table exists. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.