NIS2 Article 21 explained, the 10 risk management requirements for SMBs

NIS2 has 46 articles in total, but when supervisors come knocking, they will ask about Article 21. This is where the law specifies which risk management measures you must have. The other articles set the framework. Article 21 is where the fines live.

Subsection 2 lists 10 areas you must cover:

1. Policies for risk analysis and information security 2. Incident handling 3. Business continuity (backup, disaster recovery, crisis management) 4. Supply chain security 5. Secure acquisition, development, and maintenance of systems 6. Policies and procedures to assess the effectiveness of risk management measures 7. Basic cyber hygiene and awareness training 8. Policies and procedures for cryptography 9. Human resources security, access control, and asset management 10. Multi-factor authentication or continuous authentication, and secure communications

The first three controls are about having documented processes. It's not enough to say *"we take security seriously"*, there needs to be paper, kept up to date, and approved by leadership.

◧Control 1: Policies for risk analysis and information security

You need a written information security policy approved by leadership. There must be a risk analysis process (at least annually) where you identify threats, assess impact and likelihood, and document what you're doing about them.

Microsoft Purview Compliance Manager combined with Secure Score gives you the framework, but the policy is yours.

◧Control 2: Incident handling

You need to be able to detect, investigate, and report cyber incidents. NIS2 requires a 24-hour early warning and 72-hour formal report for serious incidents.

That presupposes you can actually see what's happening. Defender for Business (Premium) or Defender XDR (E5 or Defender Suite add-on) is the technical foundation. Plus a written incident response playbook that's been tested.

◧Control 3: Business continuity

You need to be able to keep the business running after an incident. That means documented RTO and RPO (recovery time and point objectives), tested backups, and a crisis response plan.

Microsoft 365 has built-in retention, but that's not backup, it's versioning. Microsoft 365 Backup (a separate add-on) or a third-party solution is needed to meet the requirement.

These three are about managing both what you produce and what you buy.

◧Control 4: Supply chain security

You need to assess the security of your suppliers, not just keep them on a list. That means contracts with security clauses, periodic assessments, and B2B access management.

Conditional Access for external access (Premium+) and Information Barriers (E5 or Purview Suite add-on) are the technical tools. Plus a process to assess new suppliers before signing.

◧Control 5: Secure acquisition, development, and maintenance

The most "edge case" control for typical SMBs. If you don't develop software, the requirement is mainly that you buy products with documented security properties, keep them patched, and manage configuration changes. That's Intune (patch management) plus a simple procurement checklist.

Do you develop yourself? Then it gets bigger: Defender for Cloud (Azure), SAST/DAST in the pipeline, signed code, secret scanning. That's enterprise territory.

◧Control 6: Effectiveness assessment

You need to regularly assess whether your security measures actually work. It's not enough to have policies, you need to measure.

Compliance Manager assessments (Premium+) or an annual security audit covers the requirement. Plus documentation: meeting minutes, action items, follow-through.

These two cover the technical basics you can't skip.

◧Control 7: Cyber hygiene and awareness training

Employees need regular training on phishing, password hygiene, and how to report suspicious emails.

Attack Simulator (Premium+) delivers realistic phishing simulations. Plus training material (Microsoft Learn, your own onboarding, external courses) with completion tracking.

Frequency is rarely specified. *"Regularly"* is the legal wording, but best practice is quarterly simulations and annual formal training. Keep completion reports per employee for at least 3 years.

◧Control 8: Encryption

Data must be encrypted both in transit and at rest. Microsoft 365 has this by default:

• •BitLocker on Windows devices (requires Windows Enterprise via E3+ for centrally managed; otherwise manually per device)
• •TLS for all email and web connections
• •Sensitivity Labels (Premium+) for classification and encryption of specific documents
• •Message Encryption (Premium+) for encrypted email to external recipients

Key management is the often-forgotten part: who can decrypt what, who holds root keys, what happens if a key is compromised. For an SMB, Microsoft-managed keys are normally sufficient. For heavily regulated environments, consider Customer Key (E5 or Purview Suite add-on plus Azure Key Vault).

This is where many attacks start, and where most compliance issues show up in practice.

◧Control 9: HR security, access control, and asset management

Covers the entire employee lifecycle: hiring → access → changes → termination. Plus device and data management.

• •Joiner-mover-leaver processes documented in writing
• •Least privilege, people only have access to what they need
• •Access reviews, periodic review of who has access to what (Entra ID Governance as a separate SKU or part of E5)
• •Asset management, you know which devices exist and who has them (Intune)
• •Offboarding, remove access and data on departure

◧Control 10: MFA and secure communications

Multi-factor authentication is no longer optional. NIS2 mentions it specifically, and it's typically the first thing supervisors ask about.

• •MFA on all accounts, not just admin
• •Granular MFA via Conditional Access (Premium+), require MFA in specific contexts like unfamiliar locations or risky sign-ins
• •Secure communications, encrypted Teams chat (default), and Teams Premium features for sensitive meetings if needed
• •Emergency communications, does Teams work during an outage? Do you have a backup channel?

Read individually, the 10 controls look like a checklist. They aren't, they're a connected model across 4 layers.

◧Governance layer (controls 1, 6)

Written policies plus regular assessment. This is how you manage security.

◧Operational layer (controls 2, 3, 4, 7, 9)

The processes that run daily: incident handling, business continuity, supply chain, training, and access management.

◧Technical layer (controls 8, 10)

The concrete technologies: encryption and MFA.

◧Special case (control 5)

Only relevant if you develop or build systems yourself.

Microsoft 365 primarily covers the technical layer and parts of the operational layer. The governance layer requires you to produce policies and documentation yourself. Supervisors will ask for both.

This article is an overview. The real implementation work is knowing exactly which Microsoft 365 feature covers which requirement, which licence you need, how to configure it, and what audit evidence you need to be able to produce.

Our 24-page whitepaper has the same structure for each of the 10 requirements:

• •A. Legal requirement. Citation from the directive
• •B. What it means in practice. SMB language
• •C. Microsoft 365 features, primary and supplementary
• •D. Licence requirement, minimum plan and add-ons
• •E. Configuration, where and how
• •F. Audit evidence, concrete reports and documents you need to produce

All 10 controls are open, no sign-up.