Laws and regulations
NIS2 Implementing Regulation (EU) 2024/2690
The detailed technical and methodological requirements behind the NIS2 security measures for digital infrastructure and digital service providers.
Official source Published by European Commission. EU law, free to reuse.
What it is
Commission Implementing Regulation (EU) 2024/2690 sets out the technical and methodological requirements of the NIS2 cybersecurity risk-management measures for a defined group of digital providers, and specifies when an incident affecting them counts as significant. It exists so that these largely cross-border providers face the same detailed requirements in every member state rather than 27 different interpretations.
Who it applies to
- DNS service providers and top-level domain name registries
- Cloud computing service providers, data centre service providers and content delivery network providers
- Managed service providers and managed security service providers
- Providers of online marketplaces, online search engines and social networking services platforms
- Trust service providers
- Other NIS2 entities are not legally bound by it, but many authorities and organisations use it as a reference for what good implementation of Article 21 looks like
- Status
- Binding EU implementing regulation adopted by the Commission on 17 October 2024 under NIS2 Article 21(5) and Article 23(11). It is directly applicable to the listed entity types, without national transposition.
- Enforcement
- Supervised by the national NIS2 competent authorities, generally those of the member state where the provider has its main establishment in the EU. Non-compliance is an infringement of the NIS2 obligations and is subject to the national NIS2 penalty regimes.
Key points
- Turns each NIS2 Article 21 measure into concrete requirements, for example documented policies reviewed at planned intervals, defined roles and responsibilities, and a risk treatment plan
- Requires logging and monitoring, incident handling procedures and post-incident reviews
- Requires backup, redundancy and business continuity and disaster recovery plans that are tested
- Supply chain security includes supplier selection criteria, contractual security requirements and monitoring of supplier performance
- Access control expectations include privileged account management, strong authentication and regular access reviews
- Provides objective thresholds for deciding whether an incident is significant and must be reported under NIS2
Where to start
- 1Confirm whether your service falls within one of the listed provider types and which member state has jurisdiction over you
- 2Map your existing controls, for example an ISO/IEC 27001 statement of applicability, against each section of the Annex and record gaps
- 3Encode the significant incident criteria from Article 3 and your provider-specific article into your incident triage process
How it is structured
| Articles 1 and 2 | Subject matter and the technical and methodological requirements set out in the Annex |
|---|---|
| Article 3 | General criteria for when an incident is significant |
| Articles 4 to 14 | Additional significant incident criteria per type of provider, such as cloud, data centre, managed services and trust services |
| Annex, sections 1 to 4 | Security policy, risk management policy, incident handling, business continuity and crisis management |
| Annex, sections 5 to 8 | Supply chain security, security in acquisition, development and maintenance, effectiveness assessment, cyber hygiene and training |
| Annex, sections 9 to 13 | Cryptography, human resources security, access control, asset management, environmental and physical security |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.