NIS2 Cybersecurity Risk-Management Measures: [Entity name]

Design and evidence document for the cybersecurity risk-management measures that Article 21 of the NIS2 Directive (Directive (EU) 2022/2555) requires of essential and important entities, with management body accountability (Article 20) and the incident reporting path (Article 23). For digital infrastructure and digital providers it follows the technical and methodological requirements of Commission Implementing Regulation (EU) 2024/2690 and the ENISA Technical Implementation Guidance (version 1.0, June 2025). It records entity classification, the ten minimum measures one by one, the documented reasoning where a requirement is not applied, significant incident criteria, supply chain security, effectiveness metrics and the national transposition that applies. Replace every [bracketed] value and every row marked Example. Obligations reach entities through national law: check the transposing act of each Member State that has jurisdiction and the consolidated texts. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and basis
2. Entity classification and jurisdiction
3. Governance and management body accountability
4. Risk assessment approach
5. Measures by Article 21(2) point
6. Implementation status and gap plan
7. Incident reporting design
8. Supply chain security
9. Effectiveness assessment and metrics
10. Documented reasoning for requirements not applied
11. Framework mapping
12. Supervision, enforcement and national transposition
13. Traceability matrix
14. Glossary and references

1. Purpose, scope and basis

1.1 Purpose and scope

This document shows how [Entity] meets the cybersecurity risk-management obligations of NIS2 as transposed in [Member State]. It is the design record the management body approves, the plan the security team executes and the evidence index a supervisor or auditor reviews.

1.2 Basis

NIS2 Member States had to adopt transposing measures by 17 October 2024 and apply them from 18 October 2024. The Implementing Regulation was published on 18 October 2024 and entered into force on the twentieth day after publication. On 20 January 2026 the Commission proposed targeted amendments to NIS2 (COM(2026) 13, procedure 2026/0012(COD)), and the Digital Omnibus proposal of November 2025 would add a single entry point for incident reports. Neither was adopted at the time of writing; check their status and the consolidated texts before relying on this document.

2. Entity classification and jurisdiction

2.1 Classification record

2.2 Jurisdiction

As a rule, the Member State where the entity is established has jurisdiction. Article 26 places certain digital entity types, including DNS service providers, TLD name registries, entities providing domain name registration services, cloud computing, data centre, content delivery network, managed service and managed security service providers, and online marketplaces, search engines and social networking platforms, under the Member State of their main establishment in the Union. Register with that authority (Article 27 for these entity types) and record every other Member State where national rules still apply, for example for public electronic communications.

3. Governance and management body accountability

3.1 RACI

R responsible, A accountable, C consulted, I informed.

4. Risk assessment approach

Record risks in the Risk Register (compliance/risk-register) and their treatment in the Risk Treatment Plan (compliance/risk-treatment-plan).

5. Measures by Article 21(2) point

5.1 (a) Policies on risk analysis and information system security

Annex sections 1 (security policy) and 2 (risk management, compliance monitoring, independent review).

5.2 (b) Incident handling

Annex section 3 (policy, monitoring and logging, event reporting, assessment and classification, response, post-incident review).

5.3 (c) Business continuity, backup, disaster recovery and crisis management

Annex section 4 (continuity and recovery plan, backup and redundancy, crisis management) and section 13 (supporting utilities).

5.4 (d) Supply chain security

Annex section 5 (policy and directory of suppliers). Detailed in section 8.

5.5 (e) Security in acquisition, development and maintenance, including vulnerability handling and disclosure

Annex section 6 (acquisition, secure development, configuration, change, security testing, patching, network security, segmentation, malware protection, vulnerability handling) and section 13.

5.6 (f) Policies and procedures to assess effectiveness

Annex section 7. Detailed in section 9.

5.7 (g) Basic cyber hygiene practices and cybersecurity training

Annex section 8 (awareness and hygiene, security training).

5.8 (h) Cryptography and encryption

Annex section 9.

5.9 (i) Human resources security, access control and asset management

Annex sections 10 (human resources security), 11 (access control), 12 (asset management) and 13 (physical security).

5.10 (j) Multi-factor or continuous authentication and secured communications

Annex section 11 (including multi-factor authentication, 11.7). Secured voice, video, text and emergency communications are designed here.

6. Implementation status and gap plan

7. Incident reporting design

7.1 Reporting stages

7.2 Significance criteria

For entities covered by the Implementing Regulation, an incident is significant when at least one general criterion in its Article 3 is met (for example direct financial loss above EUR 500,000 or 5% of annual turnover, whichever is lower; exfiltration of trade secrets; death or considerable damage to health; successful suspected malicious unauthorised access capable of causing severe operational disruption), when recurring incidents meet the Article 4 test (at least twice in six months, same apparent root cause, together meeting the financial loss criterion), or when an entity-type criterion in Articles 5 to 14 is met. Other entities apply Article 23(3) of NIS2 and any national thresholds.

Scheduled maintenance and its planned consequences are not significant incidents. If the pending Digital Omnibus proposal is adopted, reports may move to a single entry point; check the reporting channel in section 2.2 each year. Personal data breaches may also need GDPR notification within 72 hours; run both assessments in parallel and see the DPIA (compliance/dpia) and Incident Response Plan.

8. Supply chain security

Record the entity's own role in its customers' supply chains: as a managed service provider it is a supplier to other NIS2 entities and should expect their contract requirements. Use the Supplier Security Assessment (compliance/supplier-security-assessment) for each assessment and Supply Chain Security (security/supply-chain-security) for software components.

9. Effectiveness assessment and metrics

Report metrics to the management body quarterly. Treat a missed target for two consecutive periods as a nonconformity with a corrective action.

10. Documented reasoning for requirements not applied

11. Framework mapping

Keep the Statement of Applicability (compliance/statement-of-applicability) and the NIST CSF 2.0 Profile (compliance/nist-csf) consistent with this table.

12. Supervision, enforcement and national transposition

12.1 Enforcement exposure

12.2 National transposition register

Several Member States transposed after the October 2024 deadline, and national acts continue to change. Check the Commission's NIS2 transposition page and the national official journal for each Member State listed.

13. Traceability matrix

14. Glossary and references

14.1 Glossary

14.2 References

Standard and licence note

Based on Directive (EU) 2022/2555 (NIS2) and Commission Implementing Regulation (EU) 2024/2690 as published in the Official Journal of the European Union, with reference to ENISA's technical implementation guidance (version 1.0, June 2025). EU legislative texts are free to reuse. Article and Annex numbers are cited and obligations are summarised in original wording; no legal text is reproduced. ISO/IEC 27001 is cited by clause and control number only, without control text. Check the consolidated texts on EUR-Lex, any adopted amendments, the national transposing law of each Member State with jurisdiction and the current ENISA guidance before use. This is a documentation format, not legal advice. Template licence: MIT.