# NIS2 Article 21(2) measures mapped to the CISSP domains

Use this when an organization falls under NIS2 and you need to show which security work covers each of
the ten minimum measures. Measures are from Directive (EU) 2022/2555, Article 21(2). Domain and topic
numbers are from the ISC2 CISSP Exam Outline effective 15 April 2024. The mapping is ours, not ISC2's
or the EU's. It is a planning aid, not legal advice.

## The ten measures

- [ ] (a) Policies on risk analysis and information system security: CISSP domain 1, Security and Risk
      Management. Owner: ________ Evidence: ________
- [ ] (b) Incident handling: domain 7, Security Operations (7.6 Conduct incident management).
      Owner: ________ Evidence: ________
- [ ] (c) Business continuity, backup management, disaster recovery and crisis management: domain 1
      (1.7 Business Continuity requirements) and domain 7 (7.11 to 7.13 disaster recovery and BC
      exercises). Owner: ________ Evidence: ________
- [ ] (d) Supply chain security, including relationships with direct suppliers and service providers:
      domain 1 (1.11 Apply supply chain risk management concepts). Owner: ________ Evidence: ________
- [ ] (e) Security in acquisition, development and maintenance, including vulnerability handling and
      disclosure: domain 8, Software Development Security, and domain 7 (7.8 patch and vulnerability
      management). Owner: ________ Evidence: ________
- [ ] (f) Policies and procedures to assess the effectiveness of the measures: domain 6, Security
      Assessment and Testing (6.2 Conduct security control testing). Owner: ________ Evidence: ________
- [ ] (g) Basic cyber hygiene practices and cybersecurity training: domain 1 (1.12 security awareness,
      education and training program). Owner: ________ Evidence: ________
- [ ] (h) Cryptography and, where appropriate, encryption: domain 3, Security Architecture and Engineering
      (3.6 Select and determine cryptographic solutions). Owner: ________ Evidence: ________
- [ ] (i) Human resources security, access control policies and asset management: domain 1 (1.8 personnel
      security), domain 5, Identity and Access Management, and domain 2, Asset Security.
      Owner: ________ Evidence: ________
- [ ] (j) Multi-factor or continuous authentication, secured voice, video and text communications, and
      secured emergency communications: domain 5 (multi-factor authentication) and domain 4 (4.3 secure
      communication channels). Owner: ________ Evidence: ________

## Around the measures

- [ ] The management body has approved the measures and oversees their implementation (Article 20)
- [ ] Management body members have followed cybersecurity training (Article 20)
- [ ] The incident reporting procedure meets 24 hours, 72 hours and one month (Article 23)