A control-by-control evidence checklist for the ten cybersecurity risk-management measure areas in NIS2 Article 21.
Use it to connect each Article 21 control area to owners, policies, tests, supplier records, logs, approvals, and review triggers without treating a generic certificate as the whole evidence file.
NIS2 Article 21 requires essential and important entities to apply appropriate and proportionate technical, operational, and organisational across all ten Article 21(2) areas. This checklist shows what each evidence row should prove, who should own the measure, which design and operating records to retain, and which changes, incidents, tests, or review dates should refresh the evidence.
The evidence file should show more than the existence of a cybersecurity program. It should show that the entity has identified Article 21 controls, selected measures proportionate to its risks, implemented them for the relevant network and information systems, and kept management oversight visible.
Keep Article 20 governance evidence beside the Article 21 control evidence. Management bodies must approve the , oversee implementation, and receive training, so board or management approval records are part of the evidence trail.
Sources (2)
Article 20 and Article 21 support the governance, approval, proportionality, and risk-management evidence expected on this page.
appropriate and proportionate technical, operational and organisational measures
Article 2 requires covered entities to document why an annex requirement qualified by "where appropriate", "where applicable", or "to the extent feasible" is not appropriate, applicable, or feasible for them.
document its reasoning
Use the Article 21(2) list to organise the evidence matrix. Each example below identifies a control area, owner, implemented measure, evidence record, last review and next review trigger. The job titles and review schedules are illustrative operational choices; NIS2 does not prescribe them for every entity.
Sources (2)
Article 21(2)(a) through (e) supply the first five control areas used in the evidence matrix.
policies on risk analysis
The implementing regulation supports concrete evidence for security policies, risk treatment, incident detection, continuity analysis, supplier contracts, testing, and patch management for covered digital sectors.
security tests should inform
A policy title does not show operation. Keep design evidence, such as an approved procedure, beside operating evidence, such as a completed review, tested recovery result, representative log sample, training completion record, or closed remediation ticket.
For entities covered by Implementing Regulation (EU) 2024/2690, the annexed requirements and ENISA guidance provide additional implementation structure for digital infrastructure, ICT service management, digital provider, and trust-service contexts.
Sources (3)
Article 21(2)(f) through (j) supply the effectiveness, training, cryptography, access, asset, and authentication control areas.
assess the effectiveness
Recitals on testing, cyber hygiene, access control, MFA, asset inventory, roles, and physical security support the evidence examples listed here.
asset inventory
ENISA guidance supports practical implementation and mapping evidence for entities addressed by Implementing Regulation (EU) 2024/2690.
Technical Implementation Guidance
Build one row per Article 21 control area and one additional row for governance. Avoid a single undifferentiated folder called "NIS2 evidence"; it makes gaps hard to spot and does not show whether all ten control areas have been addressed.
For each row, keep the legal source, the internal implementation reference, the control owner, the evidence location, the latest test or approval, and the next review trigger. That structure lets legal, security, procurement, engineering, and management-body reviewers use the same record.
Sources (2)
Article 21(4) supports corrective-action tracking where an entity finds that its measures do not comply.
corrective measures
The Commission overview supports the page context that NIS2 introduces risk-management and reporting requirements across more sectors.
risk management measures
Review this checklist before presenting Article 21 evidence to management, auditors, or a competent authority. It focuses on traceability: every claim should connect to a source, an owner, an implemented measure, and retrievable proof.
Do not treat a framework mapping, supplier certificate, or general security policy as complete Article 21 evidence unless it is tied back to the specific control area and scope it supports.
Article 21 lists multiple cybersecurity risk-management measure areas. A control-by-control evidence matrix is the safer working format because it shows how each Article 21(2) area is implemented, owned, tested, and reviewed.
No. A certification or mapping can support the file, but the evidence still needs to show the entity's own scope, risks, implemented measures, management oversight, supplier context, tests, exceptions, and corrective actions.
Sources (3)
Article 21 is the source for the ten control areas and the proportionality standard used in this checklist.
shall include at least
The implementing regulation requires specific policy, test, supplier, asset, and access records for covered entities; recital 5 describes suitable compensating measures where an entity cannot implement a requirement because of its size.
compensating measures
ENISA guidance gives practical implementation context and mapping support for the technical requirements in Implementing Regulation (EU) 2024/2690.
practical advice
Sorena can help map Article 21 control areas to policies, tests, supplier records, asset evidence, access reviews, management approvals, and corrective-action tracking.
Ask questions tied to cited sources about Article 21 control evidence, implementation scope, supplier records, and technical requirements using the cited sources on this page.
Walk through your Article 21 evidence matrix, control gaps, source support, and next implementation records with Sorena.
"Cybersecurity risk-management measures"
"appropriate and proportionate technical, operational and organisational measures"
"policies on risk analysis"
"assess the effectiveness"
"corrective measures"
"shall include at least"
"technical and methodological requirements"
"document its reasoning"
"security tests should inform"
"asset inventory"
"compensating measures"
"Technical Implementation Guidance"
"practical advice"
"risk management measures"
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
NIS2 Article 34 fine levels, calculation factors, enforcement measures, GDPR overlap, and national-law checks for essential and important entities.
Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.