The 21 measures, explained simply.

Information security policies — approved at board level

A written policy approved by the board sets risk appetite, scope and review cadence — without it, every other control becomes ad hoc. ISO 27001 Annex A.5.1 is the practical reference.

Roles, responsibilities & accountability formally documented

Each control has a named owner; segregation of duties is documented for high-risk operations. Supervisors will ask “who signed off” when an incident is reviewed.

Director training on cybersecurity risk

Article 20(2) makes management training mandatory and trackable. Generic awareness modules are not enough — training must let directors understand the risks specific to their entity.

Annual independent review of the security programme

An external or independent internal audit reviewing the maturity of the programme each year. Findings are reported to the board with a remediation plan and timeline.

Risk analysis methodology and live risk register

A documented method (qualitative or quantitative) and a register reviewed at minimum quarterly. Static risk registers are a typical supervisor red flag.

Asset inventory: information systems and data

You cannot protect what you do not know you operate. The inventory must cover hardware, software, cloud services, data flows and dependencies — refreshed automatically where possible.

Business continuity & crisis management plans

Plans cover loss of site, loss of supplier and loss of access. They define RTO/RPO per service, communication protocols and the chain of command during a crisis.

Backups: tested restore procedures

Backups that have never been restored are theoretical. NIS2 expects evidence of regular restore tests, ideally including ransomware-resilient configurations (immutable, offline or air-gapped).

Multi-factor authentication on all critical access

Article 21(2)(j) explicitly requires MFA. Critical access includes admin accounts, remote access, externally-facing applications and access to sensitive data — phishing-resistant factors are increasingly expected.

Cryptography and encryption policy

A policy specifying algorithms, key lifecycle and where encryption is required (data at rest, in transit, in backups). ENISA guidance points to post-quantum readiness as a forward-looking criterion.

Network segmentation and zero-trust principles

Flat networks let an initial compromise become a sector-wide outage. Segmentation isolates critical systems; zero-trust replaces implicit trust with continuous verification of identity and device posture.

Vulnerability management and patching cadence

A documented patching SLA by severity (critical / high / medium), a process for emergency out-of-band patches and exception tracking for unpatchable systems with compensating controls.

Endpoint detection and response

EDR or XDR on workstations and servers — beyond legacy antivirus. Telemetry must be retained long enough for forensic investigation (typically 6–12 months) and feed into the SOC or MSSP.

Secure software development lifecycle

Threat modelling at design, dependency scanning in CI, secret detection, code review and runtime application testing. Applies equally to internal teams and outsourced developers.

Supplier security assessments

Risk-tier your suppliers (which ones can take you down?) and require security assessments proportional to that tier — questionnaires, certifications (ISO 27001, SOC 2) or on-site audits for the most critical.

Contractual security clauses for critical vendors

Right-to-audit, incident notification timelines (matching your own NIS2 obligations), data localisation where required, sub-processor disclosure and exit/transition assistance. The clauses must survive renewals and acquisitions.

Continuous monitoring of third-party exposure

External attack-surface monitoring, sanctions screening, breach intelligence and re-assessment when supplier ownership changes. A static annual questionnaire does not satisfy “continuous” under NIS2.

Detection, classification and escalation playbooks

Documented runbooks for the most likely scenarios (ransomware, data exfiltration, DDoS, supply-chain compromise, insider). Each runbook lists triage steps, classification criteria and the escalation chain.

24h early warning to CSIRT

Within 24 hours of becoming aware of a significant incident, an early warning to the CSIRT or competent authority — even with limited information. The clock starts at awareness, not at full understanding.

72h incident notification with severity assessment

A formal notification within 72 hours including initial severity, indicators of compromise and any cross-border impact. Updates are provided as the assessment evolves.

Final report within one month

A detailed report within one month covering the root cause, the actual impact, mitigations applied and lessons learned. The report becomes the basis for any supervisor follow-up.