---
title: "Map the NIS2 measures to controls · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/security-laws/nis2-measures
id: CMP-47
level: Required
applies: eu-users
region: EU
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 892
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Map the NIS2 measures to controls

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-47
- Level: Required
- Chapter: [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)
- Rule: If NIS2 covers you, map each of the ten measures in Article 21(2) to checked controls. Management approves them and takes training on them.
- Check: A script fails when any of the ten measures has no control in the control register, or when a mapped control's latest result failed. The management approval date is less than 12 months old.
- Risk: A law broken
- Applies when: The project has users in the EU.
- Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: The ten measures cover risk policies and incident handling. They also cover continuity and backups, supply chain security, and secure development with vulnerability handling. The rest are testing whether measures work, basic hygiene and training, cryptography, access control with asset lists, and multi-factor sign-in. Commission Implementing Regulation (EU) 2024/2690 adds detail for cloud, data centre and other digital providers. Article 20 makes the management body approve the measures and take training. Report significant incidents on the [reporting clocks](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
nis2_article_21:
  a_risk_policies: [CTL-RISK-01]
  b_incident_handling: [CTL-INC-01, CTL-INC-02]
  c_continuity_and_backup: [CTL-BACKUP-02, CTL-DR-01]
  d_supply_chain: [CTL-VENDOR-01]
  e_secure_development: [CTL-CHANGE-01, CTL-VULN-01]
  f_effectiveness: [CTL-AUDIT-01]
  g_hygiene_and_training: [CTL-TRAIN-01]
  h_cryptography: [CTL-CRYPTO-01]
  i_access_and_assets: [CTL-ACCESS-01, CTL-ASSET-01]
  j_multi_factor: [CTL-MFA-01]
management_approval: 2026-05-14
```

## Sources

- [NIS2 Article 21 on risk management measures](https://eur-lex.europa.eu/eli/dir/2022/2555/oj)
- [Commission Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj)

## Related rules

- CMP-21 [Start every reporting clock from one moment](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/reporting-clocks.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/security-laws/nis2-measures">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Decide whether NIS2 covers you](https://agentwranglers.se/playbook/compliance/security-laws/nis2-scope.md)
- Next: [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md)
- [Security laws](https://agentwranglers.se/playbook/compliance/security-laws.md)