Agent Wranglers

Product and sector laws Required

Map the NIS2 measures to controls

If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

The ten measures cover risk policies and incident handling. They also cover continuity and backups, supply chain security, and secure development with vulnerability handling. The rest are testing whether measures work, basic hygiene and training, cryptography, access control with asset lists, and multi-factor sign-in. Commission Implementing Regulation (EU) 2024/2690 adds detail for cloud, data centre and other digital providers. Article 20 makes the management body approve the measures and take training. Report significant incidents on the reporting clocks.

Example

nis2_article_21:
  a_risk_policies: [CTL-RISK-01]
  b_incident_handling: [CTL-INC-01, CTL-INC-02]
  c_continuity_and_backup: [CTL-BACKUP-02, CTL-DR-01]
  d_supply_chain: [CTL-VENDOR-01]
  e_secure_development: [CTL-CHANGE-01, CTL-VULN-01]
  f_effectiveness: [CTL-AUDIT-01]
  g_hygiene_and_training: [CTL-TRAIN-01]
  h_cryptography: [CTL-CRYPTO-01]
  i_access_and_assets: [CTL-ACCESS-01, CTL-ASSET-01]
  j_multi_factor: [CTL-MFA-01]
management_approval: 2026-05-14

How to check

A script fails when any of the ten measures has no control in the control register, or when a mapped control's latest result failed. The management approval date is less than 12 months old.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures.