NIS2 Article 21 Gap Assessment Workflow

Confirm whether the legal entity, service, country implementation, sector, and size or regardless-of-size rule bring the activity within NIS2 before scoring controls. Article 21 applies to essential and important entities, but Member State implementation and equivalent sector-specific Union rules can affect which requirements and evidence requests govern a particular service.

For the gap assessment, record the risk context that Article 21 uses: state of the art, relevant European and international standards where applicable, cost of implementation, entity size, exposure to risk, and the likelihood and severity of incidents.

Use Article 21(2) as the control taxonomy for the first pass. Each row should name the current control, owner, system or process covered, evidence location, gap rating, and remediation action.

Do not collapse supplier security, incident handling, access control, cryptography, and business continuity into one generic security-policy row. Article 21 expects coverage across multiple technical, operational, and organisational measure areas.

Commission Implementing Regulation (EU) 2024/2690 gives directly applicable technical and methodological requirements for the provider types listed in its Article 1: DNS services, TLD registries, cloud computing, data centres, content delivery networks, managed and managed security services, online marketplaces, online search engines, social networking service platforms, and trust services. It also specifies significant-incident cases for those providers. For another NIS2 entity, the regulation is a comparator, not a binding control catalogue for that entity.

When it applies, align the gap assessment to the regulation's annexed requirements and ENISA's evidence examples. For other NIS2 entities, record the national rule or supervisory expectation that turns Article 21 into a concrete control requirement.

Each assessment row should let a reviewer trace the requirement to the actual control, proof, owner, and decision on residual risk. A maturity score without that traceability is incomplete.

Use evidence that shows the measure is in place and maintained. ENISA examples include documented frameworks, risk assessments, treatment plans, approval records, procedures, logs, organisational charts, and review change logs, depending on the requirement being assessed.

Article 20 links Article 21 measures to management-body approval, oversight, training, and potential liability under Member State law. The close-out package should therefore be ready for management review, not only security-team tracking.

Before closing the assessment, confirm that residual risks have been accepted through the entity's governance process, that necessary appropriate and proportionate corrective measures are tracked without undue delay when the entity finds non-compliance with Article 21(2), and that the evidence can be retrieved for the competent authority. Customer or auditor requests may call for a separate, appropriately redacted evidence set.