What are the ten risk-management measures in NIS2 Article 21?
Article 21(2) lists the minimum areas every entity in scope must cover. In plain language: policies on risk analysis and information system security; incident handling; business continuity, such as backup management, disaster recovery and crisis management; supply chain security; security in acquiring, developing and maintaining systems, including handling and disclosing vulnerabilities; policies to assess whether the measures work; basic cyber hygiene and training; policies on cryptography and, where appropriate, encryption; human resources security, access control and asset management; and multi-factor or continuous authentication, secured voice, video and text communication and, where appropriate, secured emergency communications. Each must be appropriate and proportionate to your risks. National laws restate the list; Germany's is section 30(2) of the BSIG. NetSenX supports incident handling and effectiveness evidence, not the whole list.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.