> For the complete documentation index, see [llms.txt](https://www.mica.wtf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.mica.wtf/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/21.md). # Art. 21 — Cybersecurity risk-management measures NIS2 Article 21 — Cybersecurity risk-management measures. Directive (EU) 2022/2555, Chapter IV — Cybersecurity risk-management measures and reporting obligations. 1. Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the [security of network and information systems](https://headlesslaw.com/definitions/nis2/security-of-network-and-information-systems/) which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services. Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the [entity](https://headlesslaw.com/definitions/nis2/entity/)’s exposure to risks, the entity’s size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact. 2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following: 1. policies on risk analysis and information system security; 2. [incident handling](https://headlesslaw.com/definitions/nis2/incident-handling/); 3. business continuity, such as backup management and disaster recovery, and crisis management; 4. supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers; 5. security in network and information systems acquisition, development and maintenance, including [vulnerability](https://headlesslaw.com/definitions/nis2/vulnerability/) handling and disclosure; 6. policies and procedures to assess the effectiveness of [cybersecurity](https://headlesslaw.com/definitions/nis2/cybersecurity/) risk-management measures; 7. basic cyber hygiene practices and cybersecurity training; 8. policies and procedures regarding the use of cryptography and, where appropriate, encryption; 9. human resources security, access control policies and asset management; 10. the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate. 3. Member States shall ensure that, when considering which measures referred to in paragraph 2, point (d), of this Article are appropriate, entities take into account the vulnerabilities specific to each direct supplier and service provider and the overall quality of products and cybersecurity practices of their suppliers and service providers, including their secure development procedures. Member States shall also ensure that, when considering which measures referred to in that point are appropriate, entities are required to take into account the results of the coordinated security risk assessments of critical supply chains carried out in accordance with [Article 22(1)](/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/22.md). 4. Member States shall ensure that an entity that finds that it does not comply with the measures provided for in paragraph 2 takes, without undue delay, all necessary, appropriate and proportionate corrective measures. 5. By 17 October 2024, the Commission shall adopt implementing acts laying down the technical and the methodological requirements of the measures referred to in paragraph 2 with regard to DNS service providers, TLD name registries, [cloud computing service](https://headlesslaw.com/definitions/nis2/cloud-computing-service/) providers, [data centre service](https://headlesslaw.com/definitions/nis2/data-centre-service/) providers, [content delivery network](https://headlesslaw.com/definitions/nis2/content-delivery-network/) providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. The Commission may adopt implementing acts laying down the technical and the methodological requirements, as well as sectoral requirements, as necessary, of the measures referred to in paragraph 2 with regard to essential and important entities other than those referred to in the first subparagraph of this paragraph. When preparing the implementing acts referred to in the first and second subparagraphs of this paragraph, the Commission shall, to the extent possible, follow European and international standards, as well as relevant technical specifications. The Commission shall exchange advice and cooperate with the Cooperation Group and ENISA on the draft implementing acts in accordance with [Article 14(4)](/nis2/chapter-ii-coordinated-cybersecurity-regulatory-frameworks-art.-7-14/14.md), point (e). Those implementing acts shall be adopted in accordance with the examination procedure referred to in [Article 39(2)](/nis2/chapter-viii-delegated-and-implementing-acts-art.-38-39/39.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.mica.wtf/nis2/chapter-iv-cybersecurity-risk-management-measures-and-reporting-obligations-art.-20-25/21.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.