Executive summary

Under the NIS2 Directive, EU member states set requirements for cybersecurity risk management measures at national level in critical sectors, for example digital infrastructures, energy, transport or health. However, for several subsectors of the digital infrastructures and the ICT service management sectors, these requirements are set at European Union level due to their cross-border nature. For this purpose, the European Commission published the Implementing Regulation (EU) 2024/2690 on 17 October 2024 (1), which lays down the technical and methodological requirements of the measures referred to in Article 21(2) of Directive (EU) 2022/2555. The technical and methodological requirements are set out in Article 2 and in the Annex to this implementing regulation.

This technical guidance supports this implementing regulation by providing:

• guidance, that is, indicative and actionable advice on parameters to consider when implementing a requirement;
• examples of evidence, that is, the types of evidence that a requirement is in place; and
• mappings from security requirements to industry good practices, European and international standards, and national frameworks.

The document, as well as the implementing regulation, refers to the following type of entities:

• domain name system service providers,
• top-level domain name registries,
• cloud computing service providers,
• data centre service providers,
• content delivery network providers,
• managed service providers and managed security service providers,
• providers of online marketplaces, online search engines and social networking services platforms and
• trust service providers.

The document covers the following technical and methodological requirements:

1. policy on the security of network and information systems, 2. risk management policy, 3. incident handling, 4. business continuity and crisis management, 5. supply chain security, 6. security in network and information systems acquisition, development and maintenance, 7. policies and procedures to assess the effectiveness of cybersecurity risk-management measures, 8. basic cyber hygiene practices and security training, 9. cryptography, 10. human resources security, 11. access control, 12. asset management and 13. environmental and physical security.

To develop this technical guidance, ENISA worked closely with the European Commission and the Network and Information Systems Cooperation Group, and ENISA held a public consultation to get input from the private sector. This guidance is a living document because it maps the technical and methodological requirements referred to in Article 2 and the Annex to the implementing regulation, to European and international standards and to national cybersecurity management frameworks. Both the standards and the management frameworks are constantly subject to change. Therefore, a review process should be initiated at regular intervals by ENISA in collaboration with the European Commission and the Network and Information Systems Cooperation Group, for instance to add additional mappings industry good practices, international standards and national frameworks.

DISCLAIMER

This document is not legally binding and is only of an advisory character. It is not intended to replace the frameworks, guidance, tools or other mechanisms provided by Member States at national level.

It should be clarified that the Member States retain the freedom to determine their approach to the supervision of the requirements under this implementing regulation. Therefore, this ENISA technical guidance is not able to define whether an entity needs to have all or just some of the ‘evidence’ listed (although requiring all the ‘evidence’ listed here would be a very strict approach to supervision). This document also does not determine the appropriateness of such measures or evidence. However, it can help the national competent authorities develop their approach to the supervision of the requirements.

Entities in scope of the regulation should check under whose jurisdiction they fall and they should follow any guidance by national competent authorities (see recital 7 of the implementing regulation).

1. Apžvalga

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

3. Susiję teisės aktai

• ENISA -