---
title: "Map the NIS2 measures to controls · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures
updated: 2026-10-20
licence: "All rights reserved"
---

# Map the NIS2 measures to controls

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)
- Rule: If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.
- How: The ten measures cover risk policies and incident handling. They also cover continuity and backups, supply chain security, and secure development with vulnerability handling. The rest are testing whether measures work, basic hygiene and training, cryptography, access control with asset lists, and multi-factor sign-in. Commission Implementing Regulation (EU) 2024/2690 adds detail for cloud, data centre and other digital providers. Article 20 makes the management body approve the measures and take training. Report significant incidents on the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks).
- Check: A script fails when any of the ten measures has no control in the control register, or when a mapped control's latest result failed. The management approval date is less than 12 months old.

Example:

```yaml
nis2_article_21:
  a_risk_policies: [CTL-RISK-01]
  b_incident_handling: [CTL-INC-01, CTL-INC-02]
  c_continuity_and_backup: [CTL-BACKUP-02, CTL-DR-01]
  d_supply_chain: [CTL-VENDOR-01]
  e_secure_development: [CTL-CHANGE-01, CTL-VULN-01]
  f_effectiveness: [CTL-AUDIT-01]
  g_hygiene_and_training: [CTL-TRAIN-01]
  h_cryptography: [CTL-CRYPTO-01]
  i_access_and_assets: [CTL-ACCESS-01, CTL-ASSET-01]
  j_multi_factor: [CTL-MFA-01]
management_approval: 2026-05-14
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-measures`.

- Previous: [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/nis2-scope)
- Next: [Decide whether the Cyber Resilience Act covers your product](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-scope)
- [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws)