Meet the NIS2 Implementing Regulation Annex control by control

It is a Commission Implementing Regulation adopted on 17 October 2024 under the NIS2 Directive. Its Annex sets out the technical and methodological requirements for the Article 21(2) cybersecurity risk-management measures, and its articles define when an incident is significant. It covers DNS, TLD, cloud, data centre, CDN, managed and managed security service providers, online marketplaces, search engines, social networking platforms and trust service providers.

The NIS2 Directive sets the overall obligations and must be transposed into each Member State's national law. Regulation 2024/2690 is directly applicable and adds detail: for the listed digital providers, its Annex spells out exactly what the ten Article 21(2) measures mean in practice, such as logging, backups, network segmentation and multi-factor authentication. The Directive says what to achieve; the Annex says how.

Entities within NIS2 scope that are DNS service providers, TLD name registries, cloud computing, data centre or content delivery network providers, managed service or managed security service providers, online marketplaces, online search engines, social networking platforms or trust service providers. Organisations in other NIS2 sectors follow their national rules instead, although many use the Annex as a reference for good practice.

It can. The UK is not bound by NIS2, but a UK provider of in-scope services such as cloud, managed services or online marketplaces that offers them in the EU can fall within NIS2. Under the Directive, such providers without an EU establishment must designate a representative in a Member State, and the Annex requirements then apply to the services they provide.

The Annex has 13 sections: security policy, risk management, incident handling, business continuity and crisis management, supply chain security, secure acquisition, development and maintenance, effectiveness assessment, cyber hygiene and training, cryptography, human resources security, access control, asset management, and environmental and physical security. Each section maps to a point of NIS2 Article 21(2) and contains numbered requirements.

Penalties come from the NIS2 Directive as transposed into national law. The Directive requires maximum fines of at least 10 million euros or 2% of worldwide annual turnover for essential entities, and at least 7 million euros or 1.4% for important entities, whichever is higher. Supervisors can also issue binding instructions, order audits and, for essential entities, hold management accountable.

Closely. The Regulation states that its requirements are based on European and international standards including ISO/IEC 27001, ISO/IEC 27002 and ETSI EN 319 401. An ISO 27001 ISMS covers much of the Annex, but there are gaps to check, such as specific logging content, supplier directories, multi-factor authentication expectations and significant incident criteria. ISO 27001 certification does not by itself prove compliance.

Yes, on request. The 2024/2690 Annex is mapped in OneClickComply's control library, so support can be enabled for your organisation, though it is not yet a live self-serve framework. Once enabled, your controls, policies and automatically collected evidence are tracked against each Annex section, and work already done for ISO 27001, SOC 2 or the wider NIS2 Directive counts towards it.