NIS2 duty of care: the security measures

Short answer: Article 21 of Directive (EU) 2022/2555 (NIS2) requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage risks to their network and information systems. The measures are risk-based and grouped into ten concrete categories. The management body of the organisation bears ultimate responsibility and can be held liable for non-compliance.

Legal basis and scope

Article 21(1) of the NIS2 Directive obliges Member States to ensure that essential and important entities adopt measures proportionate to the risk, taking into account the state of the art and implementation costs. The standard is not a uniform checklist but a risk analysis that each organisation carries out itself. Article 20 further provides that the management body of an entity must approve the security measures, oversee their implementation and can be held liable for infringements. Board members are therefore required to have, or to acquire through regular training, sufficient cybersecurity knowledge.

The ten measures under Article 21(2)

The Directive specifies the following mandatory categories, elaborated for Dutch implementation practice by the NCSC:

1. Risk analysis and security policy — documented policy covering risk analysis of network and information systems.
2. Incident handling — procedures for managing cybersecurity incidents.
3. Business continuity — backup management, disaster recovery plans and crisis management.
4. Supply chain security — security aspects of relationships with direct suppliers and service providers.
5. Security in acquisition, development and maintenance — secure system procurement, development and upkeep, including patch management and vulnerability handling.
6. Effectiveness assessment — policies and procedures for periodically testing the effectiveness of security controls.
7. Cyber hygiene and training — basic digital hygiene practices and cybersecurity awareness training for staff.
8. Cryptography and encryption — policies for cryptographic standards, encryption use and key management.
9. Personnel, access and asset management — employee screening, access control and asset inventory.
10. Multi-factor authentication — use of MFA or continuous authentication solutions and secure communication channels.

Proportionality and Dutch implementation

The measures are not one-size-fits-all: each organisation weighs its size, risk exposure and sector-specific factors. The Netherlands did not meet the EU transposition deadline of 17 October 2024. The Cyberbeveiligingswet bill was submitted to the Dutch House of Representatives in 2025 and is expected to enter into force during 2026. Organisations already falling within the directive's scope are expected to voluntarily comply with the obligations pending formal enactment.