NIS2 Article 21: The 10 Security Measures — Implementation Checklist for EU Companies

As the NIS2 Directive approaches its enforcement date of 17 October 2024, EU companies must prepare to comply with its stringent security requirements. Article 21 of the directive outlines ten mandatory security measures that essential and important entities must implement. This guide provides a detailed checklist, mapping each requirement to practical technical controls, timelines, and evidence artefacts necessary for auditors.

NIS2 Article 21 — The 10 Mandatory Security Measures

NIS2 Article 21 mandates that entities implement specific security measures to manage risks posed to the security of network and information systems. The ten measures include:

1. 1Risk analysis and information system security policies
2. 2Incident handling
3. 3Business continuity and crisis management
4. 4Supply chain security
5. 5Security in network and information systems acquisition, development, and maintenance
6. 6Policies and procedures on the use of cryptography and key management
7. 7Human resources security, access control, and the management of rights
8. 8Security of network and information systems, including policies on the use of encryption and key management
9. 9Multi-factor authentication and secure communications
10. 10Testing and auditing of the security measures

These measures aim to ensure a robust security posture across all sectors, reducing vulnerabilities and enhancing resilience against cyber threats.

Risk Analysis and Information System Security Policies

Conducting Comprehensive Risk Analysis

Entities must conduct regular risk analyses to identify potential threats and vulnerabilities. This involves assessing the likelihood and impact of various risks on the organization’s network and information systems.

Technical Controls:

• Implement automated risk assessment tools.
• Regularly update risk registers.

Evidence Artefacts:

• Documented risk assessment reports.
• Updated risk management policies.

Developing Security Policies

Security policies should be comprehensive and aligned with the identified risks. These policies provide a framework for managing and mitigating risks effectively.

Technical Controls:

• Establish a centralized policy management system.
• Ensure policies are accessible to all employees.

Evidence Artefacts:

• Approved security policy documents.
• Records of policy dissemination and employee acknowledgment.

Incident Handling Procedures and Reporting Chains

Establishing Incident Response Procedures

Effective incident handling is crucial for minimizing the impact of security incidents. Entities must develop and maintain incident response procedures that enable quick detection, analysis, and response to incidents.

Technical Controls:

• Deploy an incident management system.
• Conduct regular incident response drills.

Evidence Artefacts:

• Incident response plans.
• Records of incident response exercises.

Reporting Chains

Clear reporting chains ensure timely communication of incidents to relevant stakeholders, including regulatory bodies when necessary.

Technical Controls:

• Implement automated incident reporting tools.
• Define escalation protocols.

Evidence Artefacts:

• Incident reporting logs.
• Communication records with stakeholders.

Business Continuity and Crisis Management

Developing Business Continuity Plans

Business continuity plans (BCPs) are essential for maintaining operations during and after a crisis. These plans should address various scenarios and outline recovery strategies.

Technical Controls:

• Use business continuity management software.
• Regularly test BCPs through simulations.

Evidence Artefacts:

• Documented BCPs.
• Records of BCP testing exercises.

Crisis Management Framework

A crisis management framework enables organizations to respond effectively to major disruptions, ensuring a coordinated approach across all departments.

Technical Controls:

• Establish a crisis management team.
• Deploy communication tools for crisis scenarios.

Evidence Artefacts:

• Crisis management plans.
• Training records for crisis management teams.

Supply Chain Security and Vendor Assessment

Assessing Supply Chain Risks

Supply chain security involves assessing and managing risks associated with third-party vendors. Entities must ensure that their suppliers adhere to security standards.

Technical Controls:

• Implement vendor risk management solutions.
• Conduct regular supplier audits.

Evidence Artefacts:

• Vendor risk assessment reports.
• Audit records of suppliers.

Vendor Assessment Criteria

Develop criteria for assessing vendor security posture, focusing on their ability to protect sensitive data and maintain service continuity.

Technical Controls:

• Use standardized vendor assessment questionnaires.
• Monitor vendor compliance through dashboards.

Evidence Artefacts:

• Completed vendor assessments.
• Compliance monitoring reports.

Secure Acquisition, Development, and Maintenance

Security in System Development

Security must be integrated into the acquisition, development, and maintenance of network and information systems. This includes adopting secure coding practices and conducting security testing.

Technical Controls:

• Implement secure software development lifecycle (SDLC) practices.
• Use automated security testing tools.

Evidence Artefacts:

• Secure development guidelines.
• Security testing reports.

Maintenance of Security Controls

Regular maintenance of security controls ensures their effectiveness over time, adapting to new threats and vulnerabilities.

Technical Controls:

• Schedule regular updates and patches.
• Conduct vulnerability assessments.

Evidence Artefacts:

• Patch management logs.
• Vulnerability assessment reports.

Policies on Use of Cryptography and Key Management

Cryptography Policies

Entities must establish policies governing the use of cryptography to protect data confidentiality and integrity.

Technical Controls:

• Deploy encryption solutions for data at rest and in transit.
• Implement key management systems.

Evidence Artefacts:

• Cryptography policy documents.
• Key management procedure records.

Key Management Practices

Effective key management is critical for maintaining the security of cryptographic systems, ensuring keys are generated, stored, and retired securely.

Technical Controls:

• Use hardware security modules (HSMs).
• Automate key lifecycle management.

Evidence Artefacts:

• Key management logs.
• HSM configuration records.

Human Resources Security and Access Control

Enhancing Human Resources Security

Human resources security involves implementing measures to protect against insider threats and ensure that employees adhere to security policies.

Technical Controls:

• Conduct background checks for employees.
• Provide regular security awareness training.

Evidence Artefacts:

• Training attendance records.
• Background check documentation.

Access Control Mechanisms

Access control mechanisms are essential for ensuring that only authorized personnel have access to sensitive systems and data.

Technical Controls:

• Implement role-based access control (RBAC).
• Use identity and access management (IAM) solutions.

Evidence Artefacts:

• Access control policies.
• IAM system logs.

Multi-Factor Authentication and Encrypted Communications

Implementing Multi-Factor Authentication (MFA)

MFA adds an additional layer of security by requiring users to provide multiple forms of verification before accessing systems.

Technical Controls:

• Deploy MFA solutions across all critical systems.
• Monitor MFA usage and effectiveness.

Evidence Artefacts:

• MFA implementation records.
• Authentication logs.

Ensuring Encrypted Communications

Encrypted communications protect data integrity and confidentiality during transmission, preventing unauthorized access.

Technical Controls:

• Use secure communication protocols (e.g., TLS).
• Regularly review encryption configurations.

Evidence Artefacts:

• Encryption policy documents.
• Configuration review records.

Evidence Artefacts and Implementation Timeline

To demonstrate compliance with NIS2 Article 21, entities must maintain comprehensive evidence artefacts. These artefacts serve as proof of implemented security measures and are essential for audits.

Implementation Timeline

Entities should establish a timeline for implementing each security measure, ensuring compliance by the enforcement date.

Technical Controls:

• Develop a project management plan for implementation.
• Use compliance tracking tools.

Evidence Artefacts:

• Project plans with timelines.
• Compliance status reports.

Preparing for Audits

Regular audits verify the effectiveness of security measures and ensure ongoing compliance with NIS2 requirements.

Technical Controls:

• Schedule internal and external audits.
• Use audit management software.

Evidence Artefacts:

• Audit reports.
• Remediation action plans.

Next Step with NexCyber

Prepare your organization for NIS2 compliance with NexCyber's comprehensive assessment tools. Our platform offers tailored solutions to help you implement and document the ten security measures outlined in Article 21. Visit [NexCyber](https://www.nexcyber.eu/assess?utm_source=editorial&utm_campaign=nis2-article-21-technical-measures-implementation) to start your compliance journey today.