European UnionNIS2 Directive, Cybersecurity Risk-Management Measures
Directive (EU) 2022/2555, Art. 21
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This duty reaches your service where you operate an online marketplace, online search engine or social networking services platform under Annex II and you qualify as a medium-sized enterprise or larger under the EU size-cap rule (Commission Recommendation 2003/361/EC), or regardless of size where Article 2(2), points (b) to (e), applies, for example where you are the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities. It also reaches you where you are a public administration entity of central government, or a regional one that, following a risk-based assessment by the Member State, provides services whose disruption could have a significant impact on critical societal or economic activities (Annex I and Article 2(2), point (f)), unless your activities are in the areas of national security, public security, defence or law enforcement (Article 2(7)).
- Take technical, operational and organisational measures appropriate to the risk your network and information systems face, covering at minimum a risk analysis and information-system-security policy, incident handling, business continuity and crisis management, supply chain security, and security in the acquisition, development and maintenance of your systems.NIST CSF 2.0GV.PO-01
- Maintain basic cyber hygiene practices and cybersecurity training, policies on cryptography and encryption where appropriate, human resources security and access control, and multi-factor authentication or continuous authentication solutions where appropriate.NIST CSF 2.0GV.PO-01
- Have your management body approve these measures, oversee their implementation, and complete cybersecurity training.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- If you operate an online marketplace, online search engine or social networking services platform, are not established in the Union, and offer it within the Union, designate a representative in the Union, established in one of the Member States where you offer the service; you then fall under the jurisdiction of the Member State where the representative is established.NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text. Also read by: European Union Agency for Cybersecurity (ENISA), Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, developed with the NIS Cooperation Group and the European Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 34(4): where a Member State's transposing law is infringed as to Article 21 (or Article 23), an essential entity is subject to an administrative fine of a maximum of at least EUR 10,000,000 or at least 2 percent of total worldwide annual turnover, whichever is higher. Article 34(5) sets a lower tier for an important entity, a maximum of at least EUR 7,000,000 or at least 1.4 percent of turnover, whichever is higher; that lower tier is also recorded on this instrument because Article 34 draws no separate figure for Article 21 alone. This is a directive: the figures are the floor each Member State's own transposing law must set as its statutory maximum, not a cap the Union applies directly, and a given Member State's actual ceiling may be set higher.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The competent authority designated or established by each EU Member State under Article 8 of the Directive, coordinated at Union level through the NIS Cooperation Group and the CSIRTs network.
Enforcement record
Article 21 is enforced by each Member State's own competent authority under the supervisory and enforcement measures of Chapter VII (Arts. 31 to 37). The European Commission's own NIS2 policy page describes the Directive as calling on Member States to define national cybersecurity strategies and collaborate with the EU for cross-border reaction and enforcement, and names the NIS Cooperation Group, the one standing body bringing together Member States, the Commission and ENISA on NIS2 implementation, as an issuer of non-binding guidelines and recommendations. No count, fine total or median penalty for action taken under Article 21 is published on that page.
- As of
- Source link
- https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
Settledness
- As of
- Guidance link
- https://www.enisa.europa.eu/sites/default/files/2025-06/ENISA_Technical_implementation_guidance_on_cybersecurity_risk_management_measures_version_1.0.pdf
- Guidance body
- European Union Agency for Cybersecurity (ENISA), Technical Implementation Guidance on Commission Implementing Regulation (EU) 2024/2690, developed with the NIS Cooperation Group and the European Commission
- Open questions
- Does the medium-enterprise size threshold under Article 2(1) test a social networking platform, online marketplace or search engine on a standalone basis, or does the partner-enterprise and linked-enterprise aggregation built into Commission Recommendation 2003/361/EC pull in the turnover and headcount of its wider corporate group, bearing in mind that Recital 16 lets Member States take into account the degree of independence an entity enjoys in relation to its partner or linked enterprises, in particular in terms of the network and information systems it uses and the services it provides, when applying Article 6(2) of the Annex to that Recommendation?
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32022l2555
What this law does
Article 21 requires each Member State to ensure that essential and important entities, defined by the Annex I and Annex II sector lists together with a medium-enterprise size threshold set under Article 2, take appropriate and proportionate technical, operational and organisational measures to manage the cybersecurity risks to the network and information systems they use, based on an all-hazards approach covering at least risk analysis and information system security, incident handling, business continuity, supply chain security, security in system acquisition and maintenance, the effectiveness of the measures, basic cyber hygiene and training, cryptography, human resources security and access control, and multi-factor or continuous authentication.
Annex II names online marketplaces, online search engines and social networking services platforms among the digital providers this duty reaches once they cross the medium-enterprise size threshold, or regardless of size where Article 2(2), points (b) to (e), applies, for example where the provider is the sole provider in a Member State of a service essential for the maintenance of critical societal or economic activities.
Annex I separately names public administration entities, which Article 2(2), point (f), brings in regardless of size when they are central government entities as a Member State defines them, or regional entities that, following a risk-based assessment, provide services whose disruption could have a significant impact on critical societal or economic activities, and Article 2(7) excludes public administration entities carrying out activities in the areas of national security, public security, defence or law enforcement.
A provider of an online marketplace, online search engine or social networking services platform that is not established in the Union but offers its service within it must designate a representative in the Union, established in one of the Member States where the service is offered, and falls under the jurisdiction of the Member State where that representative is established.
When LexLint raises it
When your app profile says your app operates a social platform or runs an essential service.
Back to the example · Lint your app
Page updated .