Implementing Regulation (EU) 2024/2690 · Directive (EU) 2022/2555, Article 21(2)
NIS2 technical measures: what Article 21(2) asks for
- Who it applies to
- Eleven types of digital provider, from DNS and cloud to online marketplaces and trust services.
- The dates
- In force since 7 November 2024, with no transition.
- The one thing to do
- Check your entity type first. If it is one of the eleven, the Annex applies in full and each section tells you which Article 21(2) row it answers.
NIS2 lists ten headings and says the measures must be appropriate and proportionate. This Regulation says what they are, in 161 numbered requirements. It reaches eleven types of entity and nobody else, so start there.
Pick your entity type and the answer appears here, with the provisions it rests on.
See the thirteen sectionsAt a glance
The thirteen sections, and the Article 21(2) point each answers
The mapping is the Regulation's own: each section heading names the point of Article 21(2) it implements. Two of them name more than one, so a section can answer two or three of your NIS2 rows at once.
| Section | Requirements | Implements |
|---|---|---|
| 1Policy on the security of network and information systems | 8 | 21(2)(a) |
| 2Risk management policy | 11 | 21(2)(a) |
| 3Incident handling | 22 | 21(2)(b) |
| 4Business continuity and crisis management | 14 | 21(2)(c) |
| 5Supply chain security | 8 | 21(2)(d) |
| 6Security in network and information systems acquisition, development and maintenance | 31 | 21(2)(e) |
| 7Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | 3 | 21(2)(f) |
| 8Basic cyber hygiene practices and security training | 8 | 21(2)(g) |
| 9Cryptography | 3 | 21(2)(h) |
| 10Human resources security | 10 | 21(2)(i) |
| 11Access control | 21 | 21(2)(i), 21(2)(j) |
| 12Asset management | 13 | 21(2)(i) |
| 13Environmental and physical security | 9 | 21(2)(c), 21(2)(e), 21(2)(i) |
What this replaced
Commission Implementing Regulation (EU) 2018/151, repealed by Article 15. Anybody working from the older rules on digital service providers is working from a repealed act.
Every requirement above is quoted from the Official Journal, in your language, through the catalogue this page reads. Read on 17 October 2026. The Dutch text carries its correction: Corrigendum R(03), OJ L, 2026/90675 of 7 August 2026, to point 9.2(c)(viii) of the Annex, in Dutch. EUR-Lex
Questions people ask
- Does this apply to every NIS2 entity?
- No, and it is the thing most easily got wrong. Article 1 names 11 types and calls them the relevant entities. A hospital, a bank or an energy operator is essential or important under NIS2 and outside this Annex entirely. Article 21(2) still binds them in its own terms; what this Regulation adds is the detail for the 11 it names.
- How is this different from NIS2 itself?
- NIS2 lists ten headings and says the measures must be appropriate and proportionate, which nobody can act on. This Regulation says what they are: 161 numbered requirements across thirteen sections, each stating which of Article 21(2)'s points it implements.
- Does the size of the company change what we owe?
- Not whether, only how. Article 2(1) applies the Annex to the relevant entities without a size threshold of its own. Article 2(2) then tells you to take your exposure to risk, your size and the likelihood of incidents into account when you implement. Size shapes the measure; it does not excuse it.
- Is a small incident ever reportable?
- Collectively, yes, and this is the trap. Article 4 counts incidents that are individually not significant as one significant incident. Three conditions, all of them: at least twice within six months, the same apparent root cause, and together the financial loss criterion of Article 3(1)(a).
- What happened to the old rules?
- Commission Implementing Regulation (EU) 2018/151, repealed by Article 15. It was the regulation on security requirements and incident notification for digital service providers under the first NIS Directive. Anyone still working from it is working from a repealed act.
One account, the 161 requirements already in it
Answer the entity-type question once and the 161 requirements appear with the Article 21(2) row each one answers, so the work you have already done for NIS2 counts here.
What it asks of you
161 requirements in 1 groups
Controls
161- 1.1.1 Policy on the security of network and information systems
- 1.1.2 Policy on the security of network and information systems
- 1.2.1 Roles, responsibilities and authorities
and 158 more
Related:NIS2Free tools