# What is Implementing Regulation (EU) 2024/2690 under NIS2?

It is the Commission act that sets detailed requirements for the Article 21 measures of certain digital entities. It also defines when an incident at those entities counts as significant. It applies to DNS service providers, top-level domain registries, cloud computing providers, data centre service providers, content delivery networks, managed service providers, managed security service providers, online marketplaces, online search engines, social networking platforms and trust service providers. For them, the regulation, which applies directly without national transposition, describes what each measure must contain, from risk management and incident handling to access control and cryptography. German law reflects this: section 30(3) of the BSIG gives that implementing act priority for these entity types. If you are not one of them, it is still a useful, concrete checklist for structuring your own measures, and MSP customers often expect suppliers to follow it.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [NIS2 scope and duties](https://netsenx.com/en/faq/nis2) · https://netsenx.com/en/faq/what-is-the-nis2-implementing-regulation-2024-2690

## Read next

- https://netsenx.com/en/nis2-network-monitoring
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How do national NIS2 laws differ between EU countries?](https://netsenx.com/en/faq/how-do-national-nis2-laws-differ)
- [Do I need NDR for NIS2?](https://netsenx.com/en/faq/do-i-need-ndr-for-nis2)
- [Does NIS2 require network monitoring?](https://netsenx.com/en/faq/does-nis2-require-network-monitoring)
- [What are the NIS2 incident reporting deadlines?](https://netsenx.com/en/faq/what-are-the-nis2-incident-reporting-deadlines)
- [Does NIS2 apply to mid-sized companies?](https://netsenx.com/en/faq/does-nis2-apply-to-mid-sized-companies)