What the directive asks of risk management

In this lesson

• Find every provision of NIS2 that turns risk management into an obligation, and tell what is asked of the entity from what is asked of the Member State.
• Use the definition of risk in article 6(9) to test whether a risk register actually contains risks.
• Separate three layers: what the directive requires, what Implementing Regulation (EU) 2024/2690 adds for the entities it binds, and what is professional practice.
• Place the risk function in the chain that runs from analysis to measures, approval, effectiveness and supervision.

Risk is the organising principle of article 21

Art. 21(1)

NIS2 does not hand entities a fixed list of controls to install. It asks them to manage risk. Article 21(1) requires Member States to ensure that essential and important entities take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services.”

Three features of that sentence shape the work of anyone who runs a risk process.

• It is addressed to the Member States. The obligation reaches the entity through the national law that transposes the directive. The wording of that law, the authority that supervises it and any methodology it imposes vary by country; check them on the transposition tracker rather than assuming them.
• It has two objects. The measures manage risks to the security of the systems, and they prevent or minimise the impact of incidents on recipients of the entity's services and on other services. A risk analysis that measures impact only in the entity's own losses answers half the question.
• It sets a test, not a list. Measures must be appropriate and proportionate, two words that compare a measure with a risk. Without a documented risk analysis, an entity cannot show that its measures pass either test.

What “risk” means in the directive

Art. 6(9)

Article 6(9) defines risk as “the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident”. Three consequences follow for the practitioner.

A risk is tied to an incident. Article 6(6) defines an incident as “an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems”. Every risk in the register should therefore be expressible as an incident scenario: which event would compromise which property of which data or service. Ransomware is a threat. Encryption of the dispatch platform by ransomware, stopping deliveries to hospital customers for several days is a risk.

A risk has two components. The definition says a risk “is to be expressed” as a combination of magnitude and likelihood. A register line that names a threat but states neither has not yet expressed a risk in the directive's sense.

The combination is left to the entity. The text says combination, not product. Multiplying a likelihood score by an impact score is one convention among several, and module 2 treats it as what it is: practice.

Note the fourth property. A method built on confidentiality, integrity and availability alone scores three; the directive adds authenticity, which matters wherever others rely on data or identities: signed documents, trust services, metering data, commands sent to field equipment.

Art. 6(2)

Finally, the directive does not pretend that security is absolute. Article 6(2) defines the security of network and information systems as “the ability of network and information systems to resist, at a given level of confidence, any event that may compromise” the four properties. Article 21(1), second subparagraph, then requires “a level of security of network and information systems appropriate to the risks posed.” The risk analysis is how an entity decides what that level is, and defends it.

Where risk management appears in the directive

Art. 20

Risk runs through Chapter IV and into supervision. A risk manager should know each provision.

• Article 20(1). Management bodies “approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.” The risk analysis is what makes that approval informed. Article 20(2) requires members of management bodies to follow training so that they can “identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity”.
• Article 21(1). The level of security and the proportionality factors, covered in module 2.
• Article 21(2). The all-hazards approach, covered in the next lesson, and the ten minimum measures. The list opens with point (a), “policies on risk analysis and information system security”, and includes point (f), “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”. Analysis at the start, effectiveness further on: the directive builds a loop, not a one-off exercise.
• Article 21(3). What the entity must take into account for supply chain measures, including Union-level assessments. Module 3.
• Article 21(4). Corrective measures “without undue delay” when the entity finds that it does not comply with paragraph 2. Module 3.
• Article 22. Coordinated security risk assessments of critical supply chains, carried out at Union level. Module 3.
• Articles 32 and 33. Supervisory powers, including requests for information to assess the risk-management measures, “including documented cybersecurity policies”. Module 4.

Recitals 77–78

The recitals state the intent. Recital 77: “A culture of risk management, involving risk assessments and the implementation of cybersecurity risk-management measures appropriate to the risks faced, should be promoted and developed.” Recital 78 asks the measures to “provide for systemic analysis, taking into account the human factor, in order to have a complete picture of the security of the network and information system.” Recitals do not create obligations; they state the reasons for the articles and help interpret them.

Three layers: law, implementing rules, practice

Reg. 2024/2690, art. 1–2

NIS2 risk work involves three layers. Keep them apart in your policy and in your conversations with auditors.

The directive, through national law. It sets the objectives, the minimum measures and the factors. It names no method, no scale, no review frequency and no register format.

Implementing Regulation (EU) 2024/2690. Adopted under article 21(5), first subparagraph, it lays down technical and methodological requirements for a closed list of entity types in its article 1: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers. For them, point 2 of its annex is binding: they must “perform and document risk assessments and, based on the results, establish, implement and monitor a risk treatment plan.” For every other entity, the annex is a reference for reading article 21(2)(a), not an obligation. Article 21(5), second subparagraph, allows the Commission to adopt implementing acts for other entities; national law may also set its own requirements, which you will find through the transposition tracker and the national frameworks.

Practice. Likelihood and impact scales, matrices, register layouts, workshops and the wording of appetite statements are choices the entity makes; for the entities bound by the regulation, having risk criteria and a risk tolerance level is not, as module 2 shows. These choices can be excellent, and this course teaches them, but always as practice. Risk management standards such as ISO 31000 and ISO/IEC 27005 are not required by NIS2, and this course does not reproduce them. Recital 3 of the implementing regulation states that its annex is based on standards such as ISO/IEC 27001, ISO/IEC 27002 and ETSI EN 319401, and on technical specifications such as CEN/TS 18026:2024. Based on is not the same as equal to: a certificate is not compliance.

If your risk policy says NIS2 requires a five-by-five matrix, a competent auditor will conclude that its author has not read the directive.

Same measures, different supervision

Art. 32–33

Article 21 applies to essential and important entities alike. The class changes supervision, not the measures: essential entities are subject to article 32, including regular and targeted security audits, while important entities face the ex post regime of article 33, triggered when the authority is provided with evidence, indication or information of non-compliance. What calibrates the measures themselves is proportionality, the subject of module 2.

What this course covers

This certification covers the risk function: the method, the criteria, identification and analysis, treatment and acceptance, supply chain inputs, effectiveness measurement and reporting. How to build each of the ten measures, from incident handling to multi-factor authentication, is covered by the CISO certification in the academy. The two meet in the risk treatment plan: the risk function decides what must be achieved and accepted, the security programme delivers it.

What a supervisor will ask

• What is your policy on risk analysis? The article 21(2)(a) policy: method, criteria, roles, frequency and triggers for review.
• How do you know your measures are appropriate to the risks posed? A trace from each significant scenario to the measures that address it.
• Who approved the measures, and when? The management body's approval under article 20(1), with the paper it approved.
• Are you an entity listed in article 1 of Implementing Regulation (EU) 2024/2690? If so, evidence against point 2 of its annex.

Key points

• Article 21(1) asks for appropriate and proportionate measures that manage risk to systems and limit the impact of incidents on recipients and other services.
• A risk is the potential for loss or disruption caused by an incident, expressed as a combination of magnitude and likelihood (article 6(9)).
• Risk management runs through articles 20, 21(1) to 21(4), 22, 32 and 33.
• Implementing Regulation (EU) 2024/2690 binds only the entity types in its article 1; for others its annex is a reference.
• Scales, matrices and appetite statements are practice: never attribute your chosen method to NIS2 or to an ISO standard.
• Essential and important entities apply the same measures; the class changes supervision.