NIS2 Implementing Regulation (EU) 2024/2690, explained

Commission Implementing Regulation (EU) 2024/2690, adopted by the European Commission on 17 October 2024, turns a slice of the NIS2 Directive's Article 21(2) cybersecurity risk-management measures into detailed technical and methodological requirements for a defined list of digital infrastructure and digital service providers. Per the European Commission's own description of the regulation, it applies to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers — the digital-infrastructure and digital-provider categories named in NIS2's Annex I. Unlike the Directive itself, which member states had to transpose into national law by 17 October 2024, an EU implementing regulation is directly applicable law for the entities it names, with no national transposition step required.

Why a separate implementing regulation exists

NIS2 Article 21(2) lists ten broad categories of cybersecurity risk-management measures that every essential and important entity must implement, covering areas such as risk analysis policies, incident handling, business continuity, supply chain security, and multi-factor authentication. Those categories are deliberately high-level so the single Directive text can apply across very different sectors — energy, health, transport, banking, and digital infrastructure alike. For the specific digital-infrastructure and digital-service entity types this regulation names, the Commission went a step further and adopted binding technical detail under its implementing powers, rather than leaving those ten categories to be interpreted independently by each entity or each member state's regulator. That is the regulation's stated purpose: setting out, per the Commission's own page, "technical and the methodological requirements" for those measures.

What the Annex covers

Multiple independent compliance-tooling summaries reviewed for this guide (including OpenKRITIS's NIS2 mapping page and OneClickComply's standard summary) consistently describe the regulation's Annex as expanding Article 21(2)'s ten measure categories into a larger, numbered set of requirement sections — commonly described as 13 sections containing roughly 150 individual requirements in total. The topics those summaries attribute to the Annex include, approximately:

Area	What it covers (per secondary summaries)
Policy on network and information system security	Formal written policy, management approval, defined roles and responsibilities
Risk management	A documented risk management framework, compliance monitoring, independent review
Incident handling	Detection, analysis, response, logging/monitoring, post-incident review
Business continuity and crisis management	Risk-based continuity and disaster-recovery planning
Supply chain security	Supplier selection criteria, contractual security requirements
Secure acquisition, development and maintenance	Secure development lifecycle practices, configuration and patch management, network security
Effectiveness assessment	Testing methods such as vulnerability assessment, penetration testing, code review and audits, scoped to the entity's own risk assessment
Basic cyber hygiene and security training	Staff and management awareness, extending to direct suppliers and service providers
Cryptography	A cryptography policy, key-lifecycle management, protocol and algorithm selection
Human resources security	Background verification, onboarding/offboarding, disciplinary processes
Access control	Logical and physical access control, privileged accounts, multi-factor authentication
Asset management	Classification, handling policy, inventory, removable media
Physical and environmental security	Perimeter security, supporting utilities, environmental threat protection

A note on sourcing: this guide's direct fetch of the EUR-Lex legal text for CELEX 32024R2690 did not return readable article/annex text at the time of research (EUR-Lex's rendering was not accessible to this guide's tooling), so the Annex breakdown above is drawn from the European Commission's own summary page (for scope, adoption date and the regulation's purpose) plus cross-checked third-party compliance-tooling summaries for the Annex's internal structure — not from this guide's own reading of the operative article and annex text. Treat the exact section numbering, requirement count and clause wording as to be confirmed against the official EUR-Lex text (linked in Sources) before relying on it for a compliance claim.

Proportionality: smaller scale, not smaller scope

A recurring point across the secondary summaries reviewed is that the regulation's proportionality principle is understood to reduce the scale at which a requirement must be implemented for a smaller entity, not whether that requirement applies at all — all Annex sections are described as applicable to every in-scope entity, with the depth and formality of implementation scaled to the entity's size and risk exposure. Confirm this reading against the regulation's own recitals and articles before relying on it to exclude a control entirely.

How it differs from the NIS2 Directive

	NIS2 Directive (2022/2555)	This Implementing Regulation (2024/2690)
Legal form	Directive — required national transposition	Regulation — directly applicable, no transposition
Scope	All essential/important entities across NIS2's covered sectors	A named subset: DNS, cloud, data centre, CDN, managed (security) service, online marketplace/search engine/social platform, and trust service providers
Content	High-level obligations: scope, classification, incident-reporting deadlines	Granular technical/methodological detail implementing Article 21(2) for the named entities
Guide	NIS2 Directive: Scope, Deadlines and Incident Reporting	This guide

A digital-infrastructure or managed-service provider in NIS2's scope needs to read both: the Directive for whether it is in scope at all and what its incident-reporting deadlines are, and this regulation for the specific technical bar its risk-management measures must clear.

A workable starting point

1. Confirm whether your organization is one of the named entity types before assuming this regulation — rather than the Directive's general Article 21(2) text — applies to you; it does not extend automatically to every NIS2-covered sector.
2. Map your existing controls against the Annex's section list, even at the "to be confirmed" level of detail in this guide, to identify obvious gaps (a missing cryptography policy, no documented supply-chain security criteria) before the official text review.
3. Treat proportionality as a scaling knob, not an exemption. Plan to address every Annex area at a scale appropriate to your size, rather than skipping sections a smaller organization assumes don't apply.
4. Read the official EUR-Lex text directly before making a compliance claim. This guide is a navigational summary, not a substitute for the regulation's operative articles and annex.

SoftWSP's passive OT and network security assessments help infrastructure operators produce evidence toward risk-management and incident-handling measures like the ones this regulation details: see OT security snapshot.

This guide summarises Commission Implementing Regulation (EU) 2024/2690 based on the European Commission's own description of its scope and purpose, cross-checked against independent third-party compliance summaries for the Annex's internal structure; it does not constitute legal or compliance advice, and its account of the Annex's exact wording should be confirmed against the official EUR-Lex text before being relied upon.