Article 21(2) is written as ten outcomes, not as a control catalogue. That is deliberate — and it is why the hard part is evidence, not intent.
Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems […]Directive (EU) 2022/2555
« Appropriate and proportionate » means the bar scales with your size, exposure and the societal impact of an outage. It does not mean optional.
« policies on risk analysis and information system security »
A documented, repeatable method for identifying and rating risk, and a security policy set approved by management.
« incident handling »
Detection, triage, response and recovery — and the internal escalation that lets you meet the 24-hour clock of article 23.
« business continuity, such as backup management and disaster recovery, and crisis management »
Backups you have actually restored from, a recovery plan with tested RTO and RPO, and a crisis structure that convenes.
« supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers »
The obligation most entities are least prepared for. It covers your DIRECT suppliers, and you must consider their overall quality of practices.
« security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure »
Secure development and change practices, plus a way to receive and act on vulnerability reports.
« policies and procedures to assess the effectiveness of cybersecurity risk-management measures »
Evidence that you check whether the measures work, not merely that they exist. This is the measure auditors use to test the others.
« basic cyber hygiene practices and cybersecurity training »
Baseline practices for everyone, plus role-appropriate training. Note that article 20 separately obliges management bodies to follow training.
« policies and procedures regarding the use of cryptography and, where appropriate, encryption »
A policy stating what must be encrypted, with which algorithms, and how keys are managed through their lifecycle.
« human resources security, access control policies and asset management »
Knowing what you have, who can reach it, and removing that access when people move or leave.
« the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate »
MFA is named explicitly in the directive. So are secured communications and an emergency channel that still works when your primary systems do not.
All five assessment toolkits: risk analysis, incident handling, continuity, supply chain, and access control with MFA.
Value if bought separately: 395 €