NIS2 implementing rules set technical requirements for digital-infrastructure entities

Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 lays down the technical and methodological requirements of the NIS2 risk-management measures for digital-sector entities — DNS service providers, TLD registries, cloud computing, data centres, content-delivery networks, managed and managed-security service providers, online marketplaces, search engines, social networks and trust service providers. Its annex spans the full control set: security policies, risk management, incident handling, business continuity and crisis management, supply-chain security, secure acquisition, technical security measures, cryptography, physical security, and HR and access management. It also specifies when an incident is 'significant' and therefore reportable, using concrete criteria such as direct financial loss above EUR 500 000 or 5% of annual turnover, service-unavailability durations that vary per service type, compromised data integrity or confidentiality through malicious action, user-impact thresholds, harm to health or life, and successful suspected-malicious unauthorised access.

For the digital sector, 'appropriate measures' arguments no longer suffice: the annex is a checkable control baseline, and the incident thresholds are numbers, not judgement calls. Incident-classification logic written before this regulation will not match the thresholds supervisors now apply.

The listed digital-infrastructure and digital-provider categories wherever they serve EU customers — in practice the security team owns the annex mapping and the incident-response team owns the new significance thresholds.