{
  "node_id": "eu-nis2-implementing-regulation-2024-2690",
  "title": "EU Commission Implementing Regulation (EU) 2024/2690 - NIS2 Technical and Methodological Cybersecurity Risk-Management Measures and Significant Incident Criteria (17 October 2024)",
  "domain": "Cybersecurity",
  "version": "1.0.1",
  "last_updated": "2026-04-30",
  "bluf": "Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024 lays down rules for the application of NIS2 Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and the cases in which an incident is considered significant. It applies to the relevant entities listed in NIS2 Annex II point 8: DNS service providers; TLD name registries; cloud computing service providers; data centre service providers; content delivery network (CDN) providers; managed service providers (MSPs); managed security service providers (MSSPs); online marketplaces; online search engines; social networking services platforms; and trust service providers. Article 1 sets scope; Article 2 incorporates the Annex's technical and methodological requirements implementing NIS2 Article 21(2)(a)-(j); Article 3 specifies significant-incident criteria including (a) direct financial loss exceeding EUR 500,000 or 5% of preceding-year turnover (whichever lower), (b) trade secret exfiltration, (c) death of a natural person, (d) considerable health damage, plus entity-type specific criteria in Articles 4-15. Article 16 sets entry into force on the twentieth day after publication in the OJEU. The Annex draws on ISO/IEC 27001, ISO/IEC 27002, ETSI EN 319401 and CEN/TS 18026:2024.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "eu_nis2_essential_important_entities_obligations",
      "iso_iec_27001_2022",
      "etsi_en_319401_trust_service_providers",
      "eu_cyber_resilience_act_2024_essential_requirements",
      "eu_eidas_2_amending_910_2014_2024_1183"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "eu-nis2-essential-important-entities-obligations",
    "iso-iec-27001-2022-information-security-workflow",
    "eu-cyber-resilience-act-2024-essential-requirements"
  ],
  "primary_citations_count": 20
}