Cybersecurity risk-management measures and obligations
Domain 2 - Risk-management measures and obligations
This domain tests Article 21: the risk-based, all-hazards measures that essential and important entities must adopt, and how to apply them proportionately to their exposure.
The Article 21 baseline
Entities must take appropriate and proportionate technical, operational and organisational measures to manage the risks to their network and information systems, and to prevent or minimise the impact of incidents. Measures must be based on a risk assessment and be state of the art, with cost proportionate to risk and to the entity's size. The Directive lists ten minimum areas:
- risk analysis and information system security policies;
- incident handling;
- business continuity, including backup and disaster recovery, and crisis management;
- supply chain security, including security-related aspects of supplier and service-provider relationships;
- security in acquisition, development and maintenance of systems;
- policies and procedures to assess the effectiveness of measures;
- basic cyber hygiene and cybersecurity training;
- cryptography and, where appropriate, encryption;
- human-resources security, access control and asset management;
- multi-factor or continuous authentication, secured voice/video/text communications, and secured emergency communications.
Supply-chain measures require an assessment of each supplier's practices and product vulnerabilities, not just a contractual promise. Member States may require specific standards or certified products; supervisory authorities can ask for evidence.
Worked example
A food manufacturer buys a remotely managed industrial-control system. Its risk assessment finds the supplier has remote access to a pasteurisation line. A compliant response combines contractual security requirements, network segmentation, MFA for remote access, logging, patching arrangements, a tested manual fallback for production, and periodic review of the supplier's security posture. Buying an ISO 27001-certified supplier alone does not satisfy Article 21: the manufacturer must assess and manage the residual risk in its own operations.
Traps
Treating Article 21 as a pure IT checklist ignores physical, environmental and OT risks. 'State of the art' does not mean gold-plating: measures must be proportionate. Do not assume a named standard or certificate automatically proves compliance; it is evidence, not a safe harbour. Do not forget supply chain and acquisition, which are separate minimum measures.