What is Implementing Regulation (EU) 2024/2690 under NIS2?
It is the Commission act that sets detailed requirements for the Article 21 measures of certain digital entities. It also defines when an incident at those entities counts as significant. It applies to DNS service providers, top-level domain registries, cloud computing providers, data centre service providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. For them, the regulation, which applies directly without national transposition, describes what each measure must contain, from risk management and incident handling to access control and cryptography. German law reflects this: section 30(3) of the BSIG gives that implementing act priority for these entity types. If you are not one of them, it is still a useful, concrete checklist for structuring your own measures, and MSPMSP: managed service provider. A company that runs IT for other companies. customers often expect suppliers to follow it.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
Terms used here
- MSP (managed service provider)
- A company that runs IT for other companies.