NIS2 Article 21 control baseline

The baseline should cover all ten Article 21(2) measure groups. It is not limited to technical controls: it also needs governance, incident handling, business continuity, supplier security, secure acquisition and development, effectiveness testing, cyber hygiene and training, cryptography, human resources security, access control, asset management, and appropriate authentication and secure communications.

Do not flatten those requirements into a one-row statement that the entity has a security policy. A reviewer should be able to see which control family maps to each Article 21 point and which systems, services, owners, and evidence records support it.

Article 21 is risk-based, but that does not make the baseline optional. The Directive says the level of security must be appropriate to the risks posed, taking account of state of the art, relevant European and international standards where applicable, implementation cost, risk exposure, entity size, incident likelihood, incident severity, and societal or economic impact.

For covered entities under the implementing regulation, a control that is treated as not appropriate, not applicable, or not feasible should be documented in a comprehensible way. That record is part of the baseline because it explains why the entity chose the implemented measure, compensating measure, or gap-remediation path.

Evidence should prove both design and operation. For example, a policy alone may show intent, but Article 21 evidence should also show risk treatment, role assignment, testing, supplier review, asset classification, training, and remediation where those items are relevant to the entity's services.

The implementing regulation is especially useful as an evidence model for covered digital providers because it refers to management-body approval, topic-specific policies, risk treatment plans, monitoring of events and incidents, supplier policies and contract clauses, security testing, patch management, access policy, asset inventory, and assigned cybersecurity roles.

The main under-scope risk is treating Article 21 as a security-certification mapping exercise. Certifications and standards can support a baseline, but the NIS2 record still needs to show coverage of the Directive's measure groups, the proportionality assessment, supplier-specific vulnerabilities, and the services affected by an incident.

Another common gap is overlooking the physical environment, supplier relationships, and direct service impact. Article 21 uses an all-hazards approach for network and information systems and their physical environment, and it requires supplier-security decisions to consider vulnerabilities specific to each direct supplier and service provider.

Use this checklist to turn Article 21 into a reviewable control baseline. Each item should produce an evidence record, not only a statement that the control exists.

If the entity is in a sector covered by Commission Implementing Regulation (EU) 2024/2690, check the applicable technical and methodological requirements in that regulation as part of the same baseline review.