Implementing cybersecurity risk-management measures and controls
This domain tests the Article 21 risk-management measures and Article 20 governance duties. The exam favours mapping a real control to a legal measure and showing evidence, risk rationale and management sign-off.
The minimum measures
Article 21 requires appropriate and proportionate technical, operational and organisational measures. The minimum list covers risk analysis and information-system security policies; incident handling; business continuity, backup and crisis management; supply-chain security; security in acquisition, development and maintenance, including vulnerability handling and disclosure; policies to assess effectiveness; basic cyber hygiene and training; cryptography and encryption; human-resources security, access control and asset management; and multi-factor authentication, secure communications and emergency communications. These are a floor, not a ceiling. Measures must be based on an all-hazards risk approach and proportionate to exposure.
Governance
The management body approves the measures, oversees implementation and is accountable. Members must follow training, and national law may make them liable. This means the programme needs a decision record, budget and periodic review, not just a policy PDF.
Worked example
An entity identifies credential theft as a top risk. It deploys MFA for remote access and privileged accounts, maps this to Article 21(2)(j), records the configuration baseline and authentication logs, and updates the access-control policy. The risk register shows reduced likelihood; the management body approves residual risk and the next review date. The evidence chain is risk, measure, implementation, monitoring and management decision.
Traps
Do not treat the ten measures as a tick-box checklist; proportionality and risk rationale must be shown. Do not omit management-body approval or training. Do not forget supply-chain security and vulnerability disclosure. Do not assume encryption alone satisfies access control. Do not ignore operational technology and emergency communications.