The ten NIS2 security measures, in plain words

The short version: the Law of 5 May 2026 requires ten cybersecurity measures of every entity it covers — essential and important alike. They come from Article 21 of the NIS2 Directive, and they are the checklist the ILR will hold you to. Here is what each one means in plain terms, and what "done" actually looks like.

None of the ten is exotic. What trips companies up is not understanding them — it is proving them. A control you have written into a policy but never tested is not the same thing, to a regulator or an insurer, as one you can evidence.

The ten measures, in plain words

1. Risk analysis and security policies. A written view of the risks your business actually faces, and security rules that follow from it — not a template downloaded and signed.
2. Incident handling. A plan for detecting, managing and recording incidents, so that when something happens you respond rather than improvise.
3. Business continuity. Backups that are actually tested, disaster recovery, and a way to keep operating through a crisis.
4. Supply chain security. Managing the security of the suppliers and service providers who touch your systems — and the contract terms that hold them to it.
5. Secure acquisition and development. Security built into the systems you buy, build and maintain, including how you handle and disclose vulnerabilities.
6. Testing effectiveness. A way to check that your measures actually work — not just that they exist on paper.
7. Cyber hygiene and training. The basics done consistently, and real training for your staff.
8. Cryptography. Encryption used where it matters, under a policy that says where and how.
9. Human resources, access control and asset management. Control over who can access what, what happens when people join or leave, and knowing what assets you actually have.
10. Multi-factor authentication and secure communications. Two-step login where it counts, and secured voice, video and text communications, including for emergencies.

Proportionality: all ten apply, but not to the same depth

Article 21 asks for measures that are appropriate and proportionate to your risk, size and exposure. A 60-person logistics firm is not held to the same depth as a national grid operator. But proportionality scales how far you take each measure — it does not let you skip one. All ten have to be present; the sophistication is what flexes.

Where companies actually fall short

In practice the gaps cluster in the same few places, and they are rarely the exotic ones:

1. Multi-factor authentication deployed for most accounts but not all — and the ones missing it are often the privileged ones.
2. Backups that exist but have never been restored, so nobody knows if they work.
3. No supplier security clauses, because IT contracts were signed before anyone thought about the supply chain.
4. No way to test effectiveness — measures are asserted, never checked.

These are not expensive to fix. What they need is someone to find them honestly, which is the part an internal team or the provider who built the setup cannot do for itself.

How we help

Our Compliance Audit measures you against all ten, tests what can be tested, and labels the rest honestly — so your file shows a regulator, an insurer or a client which controls rest on evidence and which rest on somebody's word. You end up with a risk assessment, a security policy, an action plan and an incident procedure written for your company, and a clear list of what to fix, in what order.

Not sure whether the law applies to you in the first place? That is a separate, quicker question — and one we answer in writing before any of this.