The ten measures from the duty of care, in plain language
If your organisation falls under the NIS2 Directive as an essential or important entity, you are subject to a duty of care: you must take appropriate measures to manage risks to your network and information systems. The Directive elaborates on this through a series of ten types of measures, listed in Article 21. They are deliberately formulated broadly so that they apply equally to an installation company with twenty employees and to an energy company with a thousand. How can you tell that a measure is properly arranged? Not by a tick box, but by three things that belong together: a concrete document or technical configuration that implements the measure, the name of someone responsible for it, and a date when it was last reviewed.
The ten measures broadly fall into four groups: understanding and documenting risks, handling incidents, managing the supply chain, and keeping people and systems in order. Below we go through them, not as a checklist to tick off but as an explanation of what each measure means in practice.
Understanding and documenting risks
The first measure is a policy for risk analysis and information security: a document describing which systems are important, what can go wrong and how you assess that. This does not need to be a lengthy report, but it should be something that an outsider — a regulator, a client, a new colleague — can read and understand. The Directive also mentions policy and procedures for assessing the effectiveness of measures: you document not only what you do, but also how you check whether it works. And there is a separate measure for cyber hygiene and training: practical ground rules and the ability of staff to recognise a suspicious email.
Handling incidents
A second group is about what happens if things do go wrong. Incident handling means there is a procedure in place for who does what as soon as an incident is detected, and how it is reported. Business continuity — including backup management, disaster recovery and crisis management — concerns how you can continue operating after a disruption or attack: do you have a current backup, do you know who coordinates the crisis, and has it ever been tested. This is the area where organisations often rely on arrangements without having tested them, and testing is precisely what a regulator or client will want to see.
Managing the supply chain
The Directive devotes a separate measure to supply chain security, including the relationship with individual suppliers. This is why non-obligated SMEs also receive questionnaires from their clients: that client must assess its own supply chain to comply with this measure. A related measure concerns security in the acquisition, development and maintenance of network and information systems, including the handling of vulnerabilities — so also how software is procured and kept up to date.
People and systems in order
The final group is the most technical, but no less concrete. Personnel security, access control and asset management concern who can access which systems and what happens when someone leaves. The use of multi-factor authentication or equivalent solutions, and secure voice, video and text communications and secure emergency communication systems, is the measure that comes closest to daily practice: can you still log into email and business systems with just a password, or is there a second step. And where applicable, this includes policy and procedures for the use of cryptography and, where relevant, encryption.
What these ten measures have in common is that they all require three things: evidence, an owner, and a moment of review. This is also exactly how a living dossier is structured, rather than a snapshot that becomes outdated after half a year. How strictly a measure must be implemented in your case depends on the size of your organization and the risks associated with your sector — the free check provides a first indication in a few questions .
For those who want to know how these ten measures translate into national law and concrete steps per topic, there is an overview per topic, tailored to your situation. This also explains which source applies to which explanation and the date it was consulted, as described on the page about where the information comes from. For the question of what exactly is free and what comes with a subscription, there is an overview of frequently asked questions.
These ten measures are a framework, not a fill-in exercise with one correct answer. What is appropriate for your organization depends on your sector, size, and the systems you depend on — the legislation itself and the regulator's guidance provide the most reliable answer. If you first want to know whether and how this duty of care applies to your organization, start with the free NIS2 check or browse the knowledge base on secria.eu.