Compliance · NIS2
NIS2: how Kayzen contributes to the measures of article 21
Article 21 of directive (UE) 2022/2555 lists ten risk management measures. For each one, here is what a tool like Kayzen can bring, and what falls to your organisation.
General information, not legal advice. Your situation and obligations are to be validated by a professional. Kayzen contributes to certain measures; it does not make any organisation compliant.
Kayzen Security is under development: no module is on sale yet. The contributions described here are based on K-Comply's technical mapping and on the actual status of each module as of 31 October 2026.
The ten measures of article 21, paragraph 2
Summaries written by Kayzen based on the text published in the Official Journal of the European Union; only that version is authoritative.
| Ref. | Measure (paraphrased) | Possible Kayzen contribution | Organisation's responsibility |
|---|---|---|---|
| 21.2.a | Risk analysis and information system security policies |
| Documented risk analysis and security policy approved by senior management, reviewed regularly. |
| 21.2.b | Incident handling |
| Incident management procedure, on-call roles and reporting of significant incidents within the deadlines of article 23. |
| 21.2.c | Business continuity, backups, disaster recovery and crisis management | Organisational measure: no software contribution | Tested continuity and recovery plan, verified offline backups, crisis unit. Kayzen does not back up your data. |
| 21.2.d | Supply chain security |
| Assessment of suppliers and service providers, security clauses in contracts, monitoring of their practices. |
| 21.2.e | Security in the acquisition, development and maintenance of systems, including vulnerability handling |
| Security requirements at purchase, secure development of in-house applications, coordinated vulnerability disclosure policy. |
| 21.2.f | Assessment of the effectiveness of risk management measures |
| Indicators monitored by senior management, internal or external audits, improvement plan. |
| 21.2.g | Basic cyber hygiene and cybersecurity training |
| Training for executives and regular awareness for employees; Kayzen does not provide training. |
| 21.2.h | Policies and procedures regarding cryptography and encryption |
| Cryptography policy: algorithms, key management, encryption of communications and backups. |
| 21.2.i | Human resources security, access control and asset management |
| Onboarding, offboarding and role change procedures, regular review of access rights, acceptable use policy. |
| 21.2.j | Multi-factor authentication, secured communications and emergency communications |
| Two-factor authentication on other applications, secure communication tools and emergency communication means. |
Evidence rather than promises
The K-Comply module calculates indicators measured on your fleet (connected agents, pending patches, disk encryption, two-factor authentication for console administrators…) and links them to the relevant measures. Evidence from a module that has not been deployed is always shown as not measured, never as satisfied.
Limits
- Governance, training, business continuity and supplier management remain entirely your organisation's responsibility.
- Reporting incidents to the authority is the entity's obligation; Kayzen can help document the incident, not report it on your behalf.
- The French transposition may specify these measures further: the mapping does not replace it.
See also
- GDPRKayzen as a processor, and its contribution to the security measures of article 32.Read the page
- ISO/IEC 27001The Annex A measures Kayzen can contribute to, by module.Read the page
- NIS2: who is affected and where to start?Who is affected, which measures, which reporting deadlines: our practical guide.Read the guide