What it asks for. Article 21 requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage risks to their network and information systems and to limit the impact of incidents. Article 21(2) lists the minimum areas measures must cover, based on an all hazards approach.
In practice. Entities run a documented risk assessment and map each Article 21(2) area to implemented controls, policies and owners, often using an established framework such as ISO 27001. Measures are proportionate to size, exposure and potential impact, take the state of the art into account and are reviewed regularly. Evidence includes the risk assessment, control mapping, policies and effectiveness reviews.
Common gaps. Organisations often treat the list as a checklist without a real risk assessment. Supply chain security and effectiveness assessment are commonly the weakest areas.