# What are the ten risk-management measures in NIS2 Article 21?

Article 21(2) lists the minimum areas every entity in scope must cover. In plain language: policies on risk analysis and information system security; incident handling; business continuity, such as backup management, disaster recovery and crisis management; supply chain security; security in acquiring, developing and maintaining systems, including handling and disclosing vulnerabilities; policies to assess whether the measures work; basic cyber hygiene and training; policies on cryptography and, where appropriate, encryption; human resources security, access control and asset management; and multi-factor or continuous authentication, secured voice, video and text communication and, where appropriate, secured emergency communications. Each must be appropriate and proportionate to your risks. National laws restate the list; Germany's is section 30(2) of the BSIG. NetSenX supports incident handling and effectiveness evidence, not the whole list.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/what-are-the-ten-nis2-article-21-measures

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What is the difference between essential and important entities under NIS2?](https://netsenx.com/en/faq/what-is-the-difference-between-essential-and-important-entities)
- [Which sectors does NIS2 cover?](https://netsenx.com/en/faq/which-sectors-does-nis2-cover)
- [Are managers personally liable under NIS2?](https://netsenx.com/en/faq/are-managers-personally-liable-under-nis2)
- [Is cyber security training mandatory for management under NIS2?](https://netsenx.com/en/faq/is-management-training-mandatory-under-nis2)
- [What do board members have to approve under NIS2 Article 20?](https://netsenx.com/en/faq/what-do-board-members-approve-under-nis2-article-20)