What “proportionate” means under NIS2
Last updated: October 20, 2026
NIS2 Article 21(1) requires security measures to be “appropriate and proportionate” to an entity's own risk, size, and exposure, not a fixed checklist applied identically to everyone. The article itself names the specific factors that determine proportionality, introducing the Article 21(2) measures that follow. Verbatim:
“Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or for the provision of their services, and to prevent or minimise the impact of incidents on recipients of their services and on other services. Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation, the measures referred to in the first subparagraph shall ensure a level of security of network and information systems appropriate to the risks posed. When assessing the proportionality of those measures, due account shall be taken of the degree of the entity's exposure to risks, the entity's size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact.”
The factors the article itself names
Read plainly, the quote above names two sets of factors:
- What measures should take into account: the state-of-the-art, relevant European and international standards where applicable, and the cost of implementation.
- What proportionality is assessed against: the entity's degree of exposure to risks, the entity's size, and the likelihood of incidents occurring and their severity, including their societal and economic impact.
That is what the article says. It does not name a required product, architecture, or vendor, and this page adds nothing to it beyond restating the two lists above.
Source
Copies checked: advisera.com, prighter.com, myctrl.tools, www.springlex.eu
Related guides
NIS2 supply chain and remote access, explained and NIS2 for small and micro manufacturers.
It takes about 2 minutes and covers NIS2, the Cyber Resilience Act, and the Machinery Regulation for machine builders, factory operators, and system integrators in the Netherlands, Belgium, and Luxembourg.
This is a general guide based on published sources, not legal advice. Confirm your specific obligations with a qualified advisor.