Chargement…
Publié le
Article 21 of NIS2 asks whether your security measures are appropriate, proportionate, and operating — a higher bar than owning a firewall and a policy PDF. A practical walk-through of the ten Article 21(2) measures, where mid-market teams fall short, and how an existing ISO 27001 programme maps onto them.
If you run security for a mid-market organisation that falls under NIS2 — a regional energy supplier, a logistics operator, a healthcare provider, a managed service provider — you have probably already answered the first question: are we in scope? For most essential and important entities, the answer is yes.
The harder question is the one Article 21 actually asks: can you show that your security measures are appropriate, proportionate, and operating? That is a different bar from "do we have a firewall and a policy PDF." This piece walks through what Article 21 requires in practice, where mid-market teams most often fall short, and how an existing ISO 27001 programme maps onto it — and where it does not.
A note on how NIS2 actually applies before we start: NIS2 is a Directive ((EU) 2022/2555), so its obligations bite on your organisation through your Member State's national transposition law, not through the Directive text directly. The article references below are to the Directive — your national implementation is the instrument that enforces them, and is where any country-specific detail lives.
Article 21(1) requires essential and important entities to take "appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems." Two words carry the weight:
And it does not stop at the security team. Article 20 makes management bodies responsible for approving the cybersecurity risk-management measures and overseeing their implementation, and provides that they can be held liable for infringements (Art. 20(1)); management must also follow training (Art. 20(2)). For mid-market entities, this is the change that most often surprises the board: NIS2 puts cybersecurity accountability on the leadership table, in writing.
Article 21(2)(a)–(j) lists the minimum measures every in-scope entity must implement. In plain language:
Read them together and a pattern emerges: Article 21 is asking for a running management system, not a binder. Measure (f) is the tell — you must be able to assess whether your own controls work.
On reporting, Article 23 sets the cadence for significant incidents: an early warning within 24 hours (Art. 23(4)(a)), an incident notification within 72 hours (Art. 23(4)(b)), and a final report within one month of that notification (Art. 23(4)(d)). The clock and the hand-offs are why incident handling (b) has to be rehearsed, not just documented.
Three measures consistently expose gaps in mid-market programmes:
If you already run an ISO/IEC 27001:2022 programme, you are not starting from zero — Annex A covers most of the technical ground Article 21 demands. The table below maps each measure to the most relevant Annex A controls (illustrative anchors, not an exhaustive crosswalk).
The catch: an ISO 27001 certificate is a strong foundation, not automatic NIS2 compliance. Three gaps remain even for certified entities:
The practical shift NIS2 demands is from having controls to evidencing them continuously. Competent authorities and auditors will expect to see live mapping between obligations and operating controls, an effectiveness-assessment trail (measure f), and a supplier-risk process you can defend. Treating Article 21 as documentation rather than a running system is the single most common — and most expensive — mistake.
Most teams already hold the raw material for NIS2 compliance inside an existing ISO 27001 programme — the work is connecting obligations to operating controls and keeping that mapping current. See how CORTEX AI approaches NIS2 Article 21 and its cross-mapping to ISO 27001 — explore the approach.