Obligation
Risk-management measures
Article 21 requires proportionate technical and organisational measures: risk analysis, incident handling, business continuity, supply-chain security, secure development, access control and cryptography.
NIS2
NIS2 raises the baseline for cybersecurity risk management, incident reporting and supply-chain accountability across essential and important entities in the EU.
- Directive (EU) 2022/2555 · national transposition ongoing
- 3 related frameworks
- 4 Wombat pillars
- Last reviewed 31 Oct 2026
Why this matters now.
The directive is deliberately outcome-oriented: member states transpose it into national law, while Article 21 sets the risk-management measures that most technical teams are asked to evidence. Wombat gives those measures a concrete architecture baseline.
What the regulation asks for.
A practical reading of the obligations that usually end up in architecture, operations and evidence reviews.
Obligation
Management accountability
Article 20 makes management bodies accountable for approving and overseeing the measures — which means the evidence has to be understandable outside the engineering team.
Obligation
Incident reporting
Article 23 introduces early warning, incident notification and final-report timelines. Detection, classification and evidence need to be repeatable before an incident happens.
Obligation
Supply-chain security
Article 21(2)(d) requires assessing the security practices of direct suppliers and service providers, including their own dependencies.
Where Wombat helps.
Each obligation maps to one or more pillars. The pillar pages show the controls, principles and evidence expectations behind the score.
WAF-SEC
Security
Identity, segmentation, vulnerability management and secure configuration are the core of the Article 21 measures.
Read the Security pillar →WAF-OPS
Operational Excellence
Runbooks, monitoring, change control and evidence collection make incident response and reporting repeatable.
Read the Operational Excellence pillar →WAF-REL
Reliability
Business continuity, backup and recovery are explicit expectations, not an afterthought.
Read the Reliability pillar →WAF-SOV
Sovereign
Supplier, jurisdiction and exit risk are part of the supply-chain assessment.
Read the Sovereign pillar →Control themes to review.
These are the control themes teams usually need to evidence. The controls catalogue is the authoritative source for the exact control-level mapping.
Risk analysis and security policy
Incident handling and reporting
Business continuity and backup
Supply-chain security
Secure development and vulnerability handling
Access control and cryptography
STEP 1
Run the WOMBATpass scorecard to establish a baseline across the relevant pillars.
STEP 2
Review the NIS2-tagged control themes in the controls catalogue and their evidence expectations.
STEP 3
Turn failed controls into a remediation plan with owners, dates and acceptance criteria.
STEP 4
Export the evidence package for management review and incident-preparedness exercises.
Related frameworks and evidence.
Wombat controls carry tags for the frameworks below. Use them to connect the technical baseline to the evidence your auditor or procurement team already expects.
ISO 27001:2022
BSI C5:2020
SOC 2 Type II
Start with a NIS2 baseline
Score the current architecture, then use the mapped control themes to build a remediation plan that survives an auditor conversation.
Wombat is a technical framework, not a law firm. These pages map relevant Wombat pillars and control themes to regulatory obligations; they do not provide legal advice. Validate the mapping against the official text and your auditor.
Related compliance hubs.
The same control baseline usually has to satisfy more than one obligation. Jump to the adjacent hub and reuse the evidence.
EU digital operational resilience
DORA
DORA brings ICT risk management, incident reporting, resilience testing and third-party oversight into one operational-resilience regime for financial entities and their critical providers.
Open the DORA hub →German cloud compliance catalogue
BSI C5
The BSI Cloud Computing Compliance Criteria Catalogue (C5) is the German benchmark for cloud security, transparency and auditability — and a common procurement requirement for cloud providers and their customers.
Open the BSI C5 hub →Cloud sovereignty criteria
BSI C3A
C3A is the BSI's non-binding criteria catalogue for digital sovereignty in cloud services. It is structured around six sovereignty categories: strategic, legal and jurisdictional, data, operational, supply chain and technology.
Open the BSI C3A hub →Control, not just location
Sovereignty
Residency, jurisdiction, key ownership, supplier concentration and exit paths — turned into controls a team can assess.
Open the sovereignty hub →