NIS2 implementing rules set technical requirements for digital-infrastructure entities

Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 lays down the technical and methodological requirements of the NIS2 cybersecurity risk-management measures, and specifies when an incident is 'significant', for digital-sector entities: DNS service providers, TLD registries, cloud computing, data centres, content-delivery networks, managed (security) service providers, online marketplaces, search engines, social networks and trust service providers.

For the digital sector, NIS2's open norms became concrete, testable requirements — including numeric thresholds for what counts as a reportable significant incident. Generic 'appropriate measures' arguments no longer suffice for these entities.

The listed digital-infrastructure and digital-provider categories under NIS2, wherever they serve EU customers.

Map your security controls to the technical requirements in the annex of Implementing Regulation 2024/2690, and recalibrate incident-classification thresholds to its 'significant incident' criteria.