What to take away
For cloud-first SMBs and mid-market entities in scope of NIS2 (either directly as Essential or Important entities or through customer supply-chain clauses), Article 21(2) comes down to repeatable SaaS, identity, third-party OAuth, data-sharing, and human-risk hygiene backed by dated operational records.
1. Understand how NIS2 reaches cloud-centric SMBs and mid-market teams
Directive (EU) 2022/2555 (NIS2) expands European cybersecurity obligations across medium-sized and larger organizations in sectors listed in Annexes I and II, while national transpositions (such as ANSSI’s framework in France and BSI’s implementation in Germany) define exact registration deadlines and supervision tiers.
Even when an SMB sits below direct headcount or turnover thresholds, Article 21(2)(d) requires regulated customers to assess the cybersecurity practices of their direct suppliers and service providers. Lean IT teams therefore face the same practical question in customer questionnaires and audits: how do you prove access control, MFA, SaaS supply-chain oversight, data protection, and staff training without hiring a dedicated GRC team?
References: EUR-Lex - Directive (EU) 2022/2555 (NIS2 Directive, Articles 20 and 21) · ANSSI - MonEspaceNIS2 official guidance and scope information
2. Map NIS2 Article 21(2) clauses to concrete SaaS and AI controls
Rather than writing abstract policy binders, link each relevant paragraph of Article 21(2) to the SaaS, identity, browser, and awareness records your team actually operates.
| NIS2 Article 21(2) measure | Cloud & SaaS operational control | Dated evidence to retain |
|---|---|---|
| (a) Risk analysis & information system policies | Shadow IT / Shadow AI inventory, data-sharing rules, and AI acceptable use policy | Dated application & AI register, approved policy PDF, and exception log |
| (b) Incident handling | Employee phishing reporting, compromised-account OAuth/link checks, and vendor breach response | Triage logs, revoked OAuth grants, and post-incident remediation records |
| (d) Supply chain security | Third-party SaaS, OAuth grant, and browser extension risk reviews plus vendor CVE/breach tracking | Approved vs revoked OAuth apps, scope decisions, and supplier security reviews |
| (g) Basic cyber hygiene & training | Recurring role-aware security training, onboarding bundles, and phishing simulations | Program completion exports, onboarding deadlines, and simulation reporting |
| (i) HR security & access control | Periodic user access reviews, orphan/former-employee detection, and cloud link cleanup | Signed-off access review exports and verified source-side account removals |
| (j) Multi-factor authentication | Enforced MFA across identity providers (Google Workspace, Entra ID, Okta) and critical SaaS | IdP MFA enforcement posture snapshots and remediation of non-compliant accounts |
References: EUR-Lex - Directive (EU) 2022/2555 (NIS2 Directive, Articles 20 and 21) · ENISA - NIS2 Technical Implementation Guidance
3. Prioritize MFA, periodic access reviews, and clean offboarding
Auditors and enterprise customers check identity hygiene first because unmanaged accounts and missing MFA remain the fastest path to business disruption. Start with your primary identity directory (Google Workspace, Microsoft Entra ID, or Okta), verify MFA enforcement for every human and admin account, and eliminate shared passwords.
Next, extend access control beyond SSO-assigned apps. Run scheduled user access reviews on critical SaaS tools, match accounts against active HR/directory rosters so former employees and unmatched accounts surface immediately, and keep decision logs separate from verified source-side removal.
References: EUR-Lex - Directive (EU) 2022/2555 (NIS2 Directive, Articles 20 and 21) · Elba Documentation - Identity and user access reviews
4. Include OAuth grants, browser extensions, and AI tools in supply-chain hygiene
In a SaaS environment, your software supply chain changes every time an employee grants OAuth scopes to a third-party app, installs a high-privilege browser extension, or pastes work data into an unreviewed AI assistant. ENISA’s technical implementation guidance highlights inventorying third-party service dependencies and limiting their access rights.
Review OAuth consents in Google Workspace, Microsoft 365, and Dropbox alongside installed browser extensions, remove dormant or over-scoped tokens, and track vendor breach or critical CVE advisories affecting connected SaaS tools so you can revoke exposed integrations promptly.
References: EUR-Lex - Directive (EU) 2022/2555 (NIS2 Directive, Articles 20 and 21) · ENISA - NIS2 Technical Implementation Guidance
5. Pair continuous cyber hygiene with measurable staff training
Article 21(2)(g) explicitly pairs basic cyber hygiene practices with cybersecurity training, and Article 20 requires management bodies to approve risk-management measures and undergo training themselves. Keep awareness practical: combine a structured onboarding bundle for new hires, recurring short modules covering phishing, SaaS sharing, and AI literacy, realistic email or QR phishing simulations, and a one-click phishing report button.
Export dated snapshots quarterly so leadership sees concrete risk reduction: accounts revoked after offboarding, public Drive or SharePoint links fixed, unapproved OAuth grants removed, and training completion across both staff and leadership.
References: EUR-Lex - Directive (EU) 2022/2555 (NIS2 Directive, Articles 20 and 21) · ANSSI - MonEspaceNIS2 official guidance and scope information · Elba Documentation - Security awareness training and policy acknowledgement
How Elba supports NIS2 operational readiness
Elba does not provide legal advice, determine your entity classification under national NIS2 laws, or submit regulatory incident notifications. Instead, Elba unifies the operational controls and exportable evidence cloud-first SMBs and mid-market teams need across Article 21(2)(d), (g), (i), and (j).
Elba connects user access reviews (across 46 connectors with verified account sync, validated CSV or screenshot imports, dated PDF summary reports, and detailed CSV decision logs), Google Workspace MFA checks and Okta read-only directory visibility, OAuth governance for Google Workspace, Microsoft 365, and Dropbox, vendor breach and Critical/High CVE Playbooks, Cloud DLP across 7 collaboration sources, Chrome/Edge/Firefox 128+/Safari 26+ Shadow AI protection, and multi-language security training (with pseudonymised CSV/XLSX auditor exports and versioned PDF policy acknowledgements) alongside phishing simulations with native Gmail and Outlook reporting.
References: Elba Documentation - Identity and user access reviews · Elba Documentation - Security awareness training and policy acknowledgement
NIS2 SaaS, identity, and human-risk readiness checklist
Your checks stay on this page and reset when you reload it.
Common questions
Does NIS2 apply to SMBs with fewer than 50 employees?
Most micro and small enterprises under 50 employees and EUR 10 million turnover fall outside direct NIS2 scope unless covered by specific Article 2 size-cap exceptions (such as trust service providers, DNS/TLD registries, or electronic communications). However, many cloud-first SMBs still have to demonstrate Article 21-aligned MFA, access control, OAuth hygiene, and training to satisfy regulated enterprise customers under Article 21(2)(d) supply-chain requirements.
How does NIS2 Article 21 relate to ISO/IEC 27001:2022?
NIS2 Article 21(2) overlaps substantially with ISO/IEC 27001:2022 Annex A controls on asset inventory (5.9), access control and rights (5.15, 5.18), supplier and cloud services (5.19 to 5.23), vulnerability management (8.8), and awareness training (6.3). Reusing one dated SaaS, OAuth, and access-review evidence pack avoids duplicate audit spreadsheets.
Are annual awareness videos enough for NIS2 Article 21(2)(g)?
No. Article 21(2)(g) pairs cybersecurity training with basic cyber hygiene practices, and Article 20 adds management-body accountability. Combine role-relevant onboarding and recurring modules with verifiable hygiene controls such as MFA, access reviews, cloud sharing cleanup, and AI prompt guardrails.
Does Elba certify our company as NIS2 compliant?
No software platform certifies NIS2 compliance or replaces incident-reporting, backup, network, or governance duties outside SaaS and workspace layers. Elba helps lean teams operate and export verifiable evidence for SaaS access, MFA posture, OAuth supply-chain risk, data sharing, browser AI controls, and employee training.
Sources & further reading
Primary documentation used to review this guide. Product settings and edition requirements can change; check the linked documentation before making changes.
- EUR-Lex - Directive (EU) 2022/2555 (NIS2 Directive, Articles 20 and 21)
- ANSSI - MonEspaceNIS2 official guidance and scope information
- ENISA - NIS2 Technical Implementation Guidance
- Elba Documentation - Identity and user access reviews
- Elba Documentation - Security awareness training and policy acknowledgement