Agent Wranglers

CMP-47Required EU law

Map the NIS2 measures to controls

If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.

By Agent Wranglers. Updated .

Region

European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The ten measures cover risk policies and incident handling. They also cover continuity and backups, supply chain security, and secure development with vulnerability handling. The rest are testing whether measures work, basic hygiene and training, cryptography, access control with asset lists, and multi-factor sign-in. Commission Implementing Regulation (EU) 2024/2690 adds detail for cloud, data centre and other digital providers. Article 20 makes the management body approve the measures and take training. Report significant incidents on the reporting clocks.

Examples

YAML example

nis2_article_21:
  a_risk_policies: [CTL-RISK-01]
  b_incident_handling: [CTL-INC-01, CTL-INC-02]
  c_continuity_and_backup: [CTL-BACKUP-02, CTL-DR-01]
  d_supply_chain: [CTL-VENDOR-01]
  e_secure_development: [CTL-CHANGE-01, CTL-VULN-01]
  f_effectiveness: [CTL-AUDIT-01]
  g_hygiene_and_training: [CTL-TRAIN-01]
  h_cryptography: [CTL-CRYPTO-01]
  i_access_and_assets: [CTL-ACCESS-01, CTL-ASSET-01]
  j_multi_factor: [CTL-MFA-01]
management_approval: 2026-05-14

How to check

A script fails when any of the ten measures has no control in the control register, or when a mapped control's latest result failed. The management approval date is less than 12 months old.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/security-laws/nis2-measures">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.