What does 'appropriate and proportionate' mean?
Article 21(1) says measures must reflect the state of the art, relevant standards, the cost of implementation, the entity's size, its exposure to risk, and the likelihood and severity of incidents. A 60-person managed service provider is not expected to run the same programme as a national energy operator, but both must cover all ten areas.
What are the ten measures and what evidence shows them?
| Article 21(2) | Measure | Example evidence |
|---|---|---|
| (a) | Risk analysis and information system security policies | Approved security policy, risk register |
| (b) | Incident handling | Incident response procedure, incident log |
| (c) | Business continuity, backup management, disaster recovery, crisis management | BCP/DR plan, restore-test records |
| (d) | Supply chain security | Supplier inventory with risk ratings and contract clauses |
| (e) | Security in acquisition, development and maintenance, incl. vulnerability handling and disclosure | Secure development policy, patch records, vulnerability disclosure policy |
| (f) | Policies to assess effectiveness of measures | Internal audit reports, KPIs, management review |
| (g) | Basic cyber hygiene and cybersecurity training | Training records, hygiene baseline |
| (h) | Cryptography and encryption | Cryptography policy, encryption configuration |
| (i) | HR security, access control, asset management | Onboarding/offboarding checklist, access reviews, asset register |
| (j) | MFA or continuous authentication, secured voice/video/text and emergency communications | MFA enforcement settings, emergency communication plan |
Who is responsible for Article 21?
Article 20 makes the management body responsible: it must approve the measures, oversee their implementation and follow training. Member states can hold management liable for infringements.
What happens if a measure is missing?
Article 21(4) requires entities that are not compliant with a measure to take, without undue delay, the necessary corrective action. Supervisors can issue binding instructions, order audits and impose fines of up to €10 million or 2% of turnover for essential entities and €7 million or 1.4% for important entities.
How does ComplyPilot help with Article 21?
ComplyPilot (EU compliance platform) maps each Article 21 measure to controls, policies, suppliers and evidence, shows readiness per category, and reuses ISO 27001 controls you already have.
What does "appropriate and proportionate" mean in Article 21?
It means the measures must fit the entity's size, its exposure to risk, and the likely impact of an incident. Article 21(1) asks entities to take account of the state of the art, relevant European and international standards, and the cost of implementation. A 60-person SaaS company is not expected to run the same security programme as a national energy grid operator.
For some digital providers, such as cloud, data centre and managed service providers, Commission Implementing Regulation (EU) 2024/2690 spells out the technical and methodological requirements in more detail.
Who is accountable for Article 21 measures?
The management body is. Article 20 requires management bodies to approve the cybersecurity risk-management measures, oversee their implementation and follow regular training. Members of management can be held liable for breaches, and for essential entities the authorities can temporarily ban a person from management duties.
What evidence shows Article 21 compliance to a supervisor?
- An approved information security policy and risk-analysis method.
- A current risk register with owners and treatment decisions.
- An incident-handling procedure that covers the 24-hour, 72-hour and one-month reporting steps.
- Business continuity and backup plans with test results.
- Supplier security requirements and reviews.
- Records of management approval and cybersecurity training.
How does ComplyPilot map Article 21?
ComplyPilot (EU compliance platform) lists the ten Article 21(2) measures as NIS2 requirements and links each to the ISO 27001 controls, policies and evidence that support it. Suppliers carry a review frequency and due date, and a separate NIS2 readiness score shows which measures still lack evidence.
What happens if an entity does not meet Article 21?
National authorities can issue binding instructions, order audits and impose fines. Under Article 34, fines reach at least EUR 10 million or 2% of worldwide annual turnover for essential entities, and at least EUR 7 million or 1.4% for important entities, whichever is higher.
Frequently asked questions
Is there an implementing act for Article 21?
Yes. Commission Implementing Regulation (EU) 2024/2690 sets detailed technical and methodological requirements for certain digital-infrastructure and ICT service entities, such as cloud and managed service providers.
Does Article 21 require ISO 27001?
No. It refers to relevant European and international standards, but does not mandate a certification. ISO 27001 is a common way to structure and prove the measures.