Implementing Regulation (EU) 2024/2690: NIS2 Security Requirements and Incident Thresholds for Digital and ICT Service Providers

It implements Directive (EU) 2022/2555, which dates from 14 December 2022 and binds the Member States, not companies.

The Directive reaches organisations only through the national law that transposes it (Article 46). The Regulation needs no such law: for its 11 entity types it is the one act under the NIS2 Directive that binds providers directly.

The Regulation names its entity types, sets out in Article 2 how far each requirement reaches, details the Article 21 measures in a 13-section Annex and fixes incident thresholds in Articles 3 to 14. ENISA explains the Annex in non-binding guidance, four national laws treat the Regulation in three ways, and one pending proposal would change implementing acts. The table below summarises the Regulation point by point.

What Is Implementing Regulation (EU) 2024/2690?

Implementing Regulation (EU) 2024/2690 is Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, document C(2024) 7151, published in OJ L, 2024/2690 of 18 October 2024 (CELEX 32024R2690), with 43 recitals, 16 articles and one Annex of 13 sections. Its 16 articles follow a fixed map in the Regulation text on EUR-Lex: Article 1 sets the subject matter and the entity types, Article 2 the technical and methodological requirements, Articles 3 and 4 the horizontal significance criteria and recurring incidents, Articles 5 to 14 the criteria per entity type, Article 15 the repeal of the earlier act and Article 16 the entry into force. The Regulation entered into force on the twentieth day after its publication (Article 16).

Legal Basis and Relationship to the Directive

The Regulation rests on two empowerments of Directive (EU) 2022/2555: Article 21(5), first subparagraph, for the technical and methodological requirements, and Article 23(11), second subparagraph, for the cases in which an incident is significant. Article 21(5) of the Directive text on EUR-Lex required the Commission to adopt the act for the digital types by 17 October 2024, and the Commission met that deadline under the examination procedure of Article 39(2). The Annex details the minimum measures of Article 21(2)(a) to (j), which Article 21(1) describes as technical, operational and organisational, and the parent page explains the ten Article 21 risk-management measures.

Article 21(5), second subparagraph, lets the Commission adopt implementing acts for other essential and important entities, and none has been adopted as of 23 October 2026. No implementing act under Article 23(11), first subparagraph, on the type of information, format and procedure of notifications exists either. The Commission announced on 26 May 2026 that the NIS Cooperation Group adopted common templates for incident reporting at its 39th plenary meeting in Cyprus; the Commission plans to make them mandatory through an implementing act.

Status, Corrigenda and the Repealed Regulation 2018/151

As of 23 October 2026 the Regulation has not been amended: the only consolidated version is the original text, and three corrigenda correct single language versions. Corrigendum R(01) of 12 March 2025 (OJ L 2025/90225) concerns the Polish version, R(02) of 16 April 2025 (OJ L 2025/90331) the Swedish version and R(03) of 7 August 2026 (OJ L 2026/90675) the Dutch version.

Article 15 repeals Commission Implementing Regulation (EU) 2018/151 of 30 January 2018 (OJ L 26, 31.1.2018, p. 48), the NIS1 act for digital service providers. In the EEA, EFTA's EEA-Lex lists the Regulation as under scrutiny for incorporation by Iceland, Liechtenstein and Norway, with no EEA Joint Committee Decision as of 23 October 2026. Online marketplaces, online search engines and cloud computing services were digital service providers under NIS1, and the shift of regimes is compared in NIS2 vs NIS1.

Which Entity Types Does the Regulation Bind?

Implementing Regulation (EU) 2024/2690 binds exactly 11 entity types under Article 1: DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers. Article 23(11), second subparagraph, of the Directive does not list trust service providers, yet recital 2 brings them under the significance rules as well, for coherence. For all 11 types the Regulation applies in every Member State without national transposition, as the table below shows.

Entities Outside the Eleven Types

Every other essential or important entity, including internet exchange point providers, public electronic communications providers and domain name registration service providers, is not bound by the Regulation and follows the measures list of its national law. The same holds for the remaining sectors of Annex I and II, such as energy, health and manufacturing: none of them appears in Article 1.

For these entities, the significance of an incident follows Article 23(3) of the Directive, read with national practice, not Articles 3 to 14. The Regulation still reaches them where a national law adopts its text, as Austria does.

How Article 2 Sets the Technical and Methodological Requirements

Article 2(1) of Implementing Regulation (EU) 2024/2690 places the technical and methodological requirements for the ten measures of Article 21(2)(a) to (j) NIS2 in the Annex, and Article 2(2) tells the entity how far each requirement reaches. The Annex is therefore the operative list, and Article 2 is its reading rule.

Proportionality Factors and Compensating Measures

Article 2(2) makes four factors decide how a requirement is applied: the entity's degree of exposure to risks, its size, the likelihood of incidents and their severity, including their societal and economic impact. Recital 5 adds that entities unable to implement a requirement because of their size may take compensating measures. In micro entities, for example, targeted management oversight or increased monitoring and logging can replace segregation of duties. Recital 6 lets national competent authorities take into account the time an entity needs to implement the requirements. These factors repeat the Directive's own test, which also weighs the state of the art and the cost of implementation, explained under state of the art and proportionality under Article 21(1).

Documenting Why a Requirement Is Not Applied

Where an Annex requirement applies only "where appropriate", "where applicable" or "to the extent feasible" and the entity does not apply it, Article 2(2) obliges the entity to document its reasoning in a comprehensible manner. Counted in the Annex text, "where appropriate" appears 48 times, "where applicable" 10 times and "to the extent feasible" 4 times, 62 occurrences in total (calculated).

These qualifiers do not make a requirement optional. They shift the decision to the entity and attach a record to it: an entity that skips background checks for one role keeps the written reasoning that links the decision to its exposure, size and risk. That record is the evidence a competent authority asks for in a supervisory review.

What the Annex Requires, Section by Section

The Annex of Implementing Regulation (EU) 2024/2690 has 13 sections, and each one is headed with the point of Article 21(2) NIS2 that it details, so sections 1 and 2 serve point (a) and section 13 serves points (c), (e) and (i). The table below gives one row per section with a key requirement and the measure page that covers it.

Section-by-section detail sits on each measure page.

Duties Addressed to Management Bodies

Four Annex points give the management bodies of the 11 entity types concrete tasks: the security policy shows the date of their formal approval (Annex point 1.1.1(k)), they review it at least annually (1.1.2), at least one person reports directly to them on security (1.2.3), and they or accountable persons accept residual risks (2.1.1). The review under point 1.1.2 also follows significant incidents and significant changes, and point 2.3.3 sends the results of independent reviews to the management bodies for corrective action or risk acceptance. These points add operational detail to the general duty of the Directive, explained as what management bodies must approve and oversee under Article 20.

Fixed Review Points and Planned Intervals

The Annex fixes a minimum frequency in only three places, the policy review (1.1.2), the risk assessment and treatment plan (2.1.4) and the review of roles (10.1.3), each "at least annually". Everywhere else the text says "planned intervals", 30 times in all, so the entity sets the interval and records it. One duty is quarterly: the check for recurring incidents under Annex point 3.4.2(b).

ENISA's guidance recommends annual cycles for further tasks, such as compliance monitoring, independent review, incident response and continuity tests, supply chain, cryptography and access rights reviews. These cadences are recommendations, not law.

Standards Behind the Annex

Recital 3 names the standards the Annex requirements are based on: ISO/IEC 27001, ISO/IEC 27002, ETSI EN 319401 and CEN/TS 18026:2024. The Regulation does not name a certificate under any of these standards as proof of compliance with the Annex. IEC 62443 is not cited in the Regulation or the Directive. The control-by-control overlap is set out in NIS2 vs ISO/IEC 27001.

How the Regulation Sets Incident Thresholds

For its 11 entity types, Implementing Regulation (EU) 2024/2690 makes an incident significant when it meets at least one horizontal criterion of Article 3(1) or one type-specific criterion of Articles 5 to 14, and these criteria are exhaustive for those types. The financial criterion of Article 3(1)(a) is a direct loss exceeding EUR 500,000 or 5 % of the total annual turnover of the preceding financial year, whichever is lower. For a provider with a turnover of EUR 4,000,000, 5 % equals EUR 200,000, which is lower than EUR 500,000, so the financial threshold is EUR 200,000 (calculated). Article 3(2) excludes scheduled interruptions and the planned consequences of scheduled maintenance.

Article 4 treats incidents as recurring when they occur at least twice within six months, share the same apparent root cause and together meet the financial criterion. The reporting stages do not change: early warning within 24 hours, incident notification within 72 hours and a final report not later than one month after the notification (Article 23(4)(a), (b) and (d) of the Directive), with 24 hours for the notification of trust service providers on incidents affecting their trust services.

Recital 30 makes the criteria exhaustive for the 11 types without prejudice to Article 5 of the Directive, which lets Member States adopt or maintain a higher level of cybersecurity. The table below gives the thresholds in summary, and the full criteria per type are explained under what makes an incident significant under NIS2.

The ENISA Technical Implementation Guidance and Mapping Table

ENISA's NIS2 Technical Implementation Guidance, version 1.0 of 26 June 2025, explains each Annex requirement of Implementing Regulation (EU) 2024/2690 with guidance, examples of evidence and tips, and it is not legally binding. The 170-page document was developed with the European Commission and the NIS Cooperation Group, and ENISA advises companies to consult their national authority first. The guidance, published on the ENISA guidance page, lists ten documented topic-specific policies: risk management, incident handling, supply chain security, security testing, effectiveness assessment, cryptography, access control, privileged and administrator accounts, handling of information and assets, and removable media.

The companion mapping table links the Annex in 49 rows to eight named frameworks and a French column, listed in the table below. ENISA states that the mapping "should not be interpreted as a measure of equivalency" among standards or frameworks. Version 1.0 dates from 26 June 2025 and version 1.1 from 10 July 2025; the current release is version 1.2 of the ENISA mapping table.

Guidance values are not law. ENISA suggests passwords of at least 8 characters for accounts with MFA and 14 without, ranks phishing-resistant MFA as strongest and SMS or e-mail one-time codes as a last resort, and recommends identity reviews at least quarterly, annually for micro entities. The Annex itself requires multi-factor or continuous authentication only "where appropriate" (point 11.7.1), so these values serve as a benchmark, not a legal minimum.

How National Laws Treat the Regulation

National NIS2 laws handle the Regulation in three ways in the four Member States in the table below: Germany gives it precedence for the 11 types, Austria extends its Article 2 and Annex to every entity type of its national law, and the Netherlands and France keep their national measures for the other entities only. The status of every national act is followed in the NIS2 transposition tracker.

For the 11 types, the Regulation's measures and thresholds apply directly in all four countries, while national law decides which competent authority supervises the entity, how it registers and which fines apply under the rules transposing Article 34.

How to Implement the Annex Requirements

Implement the Regulation in six steps and keep the evidence of each step, because the documented reasoning under Article 2(2) is part of compliance. The six steps are listed below.

1. Confirm the entity type under Article 1 and whether the Directive applies at all, starting with the NIS2 scope check.
2. Run a NIS2 gap analysis against the Annex, section by section across all 13 sections.
3. Record every "where appropriate", "where applicable" and "to the extent feasible" decision with its reasoning (Article 2(2)).
4. Have the management bodies approve the security policy and accept residual risks (Annex points 1.1.1(k) and 2.1.1).
5. Set the incident classification against Articles 3 to 14, including the quarterly recurring-incident check.
6. Check the national additions: precedence in Germany, the extension in Austria and the exclusions in the Netherlands and France.

What Changes Are Proposed for Implementing Acts?

One pending proposal would change how NIS2 implementing acts work: COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) would stop Member States from adding further technical, methodological or sectoral requirements for entities covered by such an act, and as of 23 October 2026 it is pending, with the European Parliament at the stage "Awaiting committee decision". The stage is recorded in the EP Legislative Observatory.

The proposal would also have the Commission regularly assess whether sectoral implementing acts for other sectors are needed, with an open consultation. It would require ransomware data in a future implementing act on notifications, not in Regulation 2024/2690, and a cyber posture certificate under the proposed revision of the Cybersecurity Act would exempt an entity from additional audits for the covered requirements. All pending changes are tracked under NIS2 amendments and review.

Implementing Regulation Questions

Five questions recur about Implementing Regulation (EU) 2024/2690.

Does Regulation 2024/2690 apply to every organisation under NIS2?

No: it binds only the 11 digital and ICT service provider types of Article 1, and every other entity follows the measures of its national law, unless that law extends the Regulation, as Austria's NISV 2026 does.

Does the Regulation need a national law to apply?

No: as an implementing regulation it is binding in its entirety and has been directly applicable in all Member States since 7 November 2024 (Article 16), unlike the Directive, which binds companies only through national law.

Is the ENISA guidance legally binding?

No: ENISA's Technical Implementation Guidance and its mapping table are advisory; only the Regulation's articles and Annex are law.

Does the Annex require multi-factor authentication for every account?

No: Annex point 11.7.1 requires multi-factor or continuous authentication where appropriate, in line with the classification of the asset, and a decision not to use it must be documented under Article 2(2). The requirement is explained under multi-factor authentication under Article 21(2)(j).

Which act did Regulation 2024/2690 replace?

It repealed Commission Implementing Regulation (EU) 2018/151, the NIS1 rules for digital service providers (Article 15).