NIS2 Implementing Regulation 2024/2690 for Digital Infrastructure and ICT Providers

NIS2 sets the directive-level obligations; implementing regulations detail technical and methodological expectations for certain entity types. Regulation (EU) 2024/2690 is one such measure aimed at digital infrastructure / ICT-related contexts.

Read it beside your Member State transposition and sector guidance — do not assume a single EU PDF replaces national supervisory practice.

Hedge: Confirm applicability to your entity class in the Official Journal text and national authority materials before asserting article-level duties.

Role of implementing acts

They specify how certain risk-management and measurement expectations should be met for in-scope digital providers. Map sections to your control library with owners.

Evidence preparation

Risk management policies sized to service criticality
Incident reporting runbooks aligned to national CSIRT/authority paths
Supply-chain security artefacts
Business continuity and backup proof

Operating model

Treat IR requirements as living control objectives reviewed when services or dependency graphs change.

How CyberSilo Helps

Evidence mapping in CyberSilo CSA
Detection and logging proof with ThreatHawk SIEM
Advisory scoping — contact CyberSilo

Talk to CyberSilo

Map evidence and operations with CyberSilo CSA and ThreatHawk.

Talk to CyberSilo NIS2 hub

Frequently Asked Questions

Does 2024/2690 apply to every NIS2 entity?

No — check the regulation's scope and your entity designation.

Is national law still relevant?

Yes — transposition and supervisory practice matter.

How does CSA help?

Maps directive + implementing expectations into evidence tasks.

NIS2 Implementing Regulation 2024/2690 for Digital Infrastructure and ICT Providers

Role of implementing acts

Evidence preparation

Operating model