NIS2 Article 21 Risk-Management Measures Checklist

Governance and risk analysis

• Risk analysis and information system security policies are documented and current
• Management body has formally reviewed and approved the risk-management measures (Article 20)
• Policies and procedures exist to assess the effectiveness of risk-management measures

Operational resilience

• Incident handling process is documented and has been exercised
• Business continuity plan covers backup management, disaster recovery, and crisis management
• Basic cyber hygiene practices and cybersecurity training are in place for all relevant staff

Technical and supply-chain controls

• Supply chain security assessment process covers every supplier whose compromise could materially affect the entity
• Security is built into network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure
• Policies exist on the use of cryptography and, where appropriate, encryption
• Human resources security, access control policies, and asset management are documented
• Multi-factor authentication, secured communications, and secured emergency communication systems are deployed where appropriate