[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2-implementing-regulation\u002Foverview":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2-implementing-regulation","overview","Annex 3.2","Commission Implementing Regulation (EU) 2024\u002F2690",0,"European Commission","**What it asks for.** This implementing regulation sets out the technical and methodological requirements of the NIS2 risk management measures for certain digital entities, including DNS providers, TLD registries, cloud and data centre providers, content delivery networks, managed and managed security service providers, online marketplaces, search engines, social networks and trust service providers. It also defines when incidents affecting them are significant.\n\n**In practice.** Its annex translates each area of NIS2 Article 21(2) into detailed requirements, for example on incident handling, monitoring and logging, business continuity, supply chain, access control and cryptography. In scope entities should map their controls against the annex and document how each requirement is met or why a proportionate approach is justified. Other organisations often use it as a reference for what good looks like.\n\n**Common gaps.** Entities often overlook that it applies directly as a regulation, without national transposition. Detailed areas such as logging and effectiveness assessment are frequently underestimated.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg_impl\u002F2024\u002F2690\u002Foj","Read the regulation on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]