Implementing Regulation (EU) 2024/2690 (CIR): who it binds and what it requires
Commission Implementing Regulation (EU) 2024/2690, the CIR for short, sets out in detail how certain digital providers put the ten NIS2 security measures in place, and when an incident at them is significant. It applies directly in every EU country, but only to eleven types of provider, such as cloud, data centres and managed services. For every other company it is not the yardstick, only a possible reference.
Who the regulation binds
Article 1 names eleven types of entity. The regulation calls them the “relevant entities”.
Art. 1 and 16 Implementing Regulation (EU) 2024/2690
- DNS service providers
- TLD name registries
- Cloud computing service providers
- Data centre service providers
- Content delivery network providers
- Managed service providers
- Managed security service providers
- Providers of online marketplaces
- Providers of online search engines
- Providers of social networking services platforms
- Trust service providers
It is a regulation, not a directive. That is why it applies in every EU country without a national law. It was published in the Official Journal on 18 October 2024 and entered into force 20 days later.
Whether such a provider falls under NIS2 at all is decided by the directive and the national law, in Germany § 28 BSIG. The regulation only says how exactly it puts the measures in place.
What the Annex requires
The Annex has 13 sections. Each belongs to a point of Art. 21(2) NIS 2 and has numbered individual requirements.
No. 1
Policy on the security of network and information systems
A policy document that management reviews at least once a year, plus clear roles and responsibilities.
No. 2
Risk management policy
Identify, assess and treat risks. The results are reviewed at least once a year.
No. 3
Incident handling
Detect, log, classify, handle and review incidents.
No. 4
Business continuity and crisis management
Contingency plans, backups and redundancy, crisis management.
No. 5
Supply chain security
A policy for the relationships with direct suppliers and a register of those suppliers.
No. 6
Acquisition, development and maintenance
Security when buying and developing systems, changes, testing, updates and handling vulnerabilities.
No. 7
Assessing effectiveness
Decide how to check whether the measures work.
No. 8
Cyber hygiene and training
Basic rules for everyone, awareness and training, including for management.
No. 9
Cryptography
A policy on encryption, with key management.
No. 10
Human resources security
Responsibilities, screening where appropriate, and procedures for leavers and role changes.
No. 11
Access control
Access rights, privileged accounts, identification, authentication and, where appropriate, multiple factors (no. 11.7).
No. 12
Asset management
An inventory of systems and assets, their classification and their handling.
No. 13
Environmental and physical security
Protection against loss of supply, fire and water, controlled physical access.
Proportionality applies here too: risk, size, and the likelihood and severity of incidents count (Art. 2(2)). Where the Annex says “where appropriate” and a provider does not apply a requirement, it documents why in an understandable way.
When an incident is significant
For the relevant entities, the regulation sets when an incident is significant and therefore has to be reported. Article 3 applies to all of them: for example a direct financial loss of more than EUR 500,000 or 5 percent of annual turnover, whichever is lower, the exfiltration of trade secrets, or a successful, suspectedly malicious access that can cause severe operational disruption.
If at least two incidents with the same apparent cause occur within six months and together reach the financial loss threshold, they count together as significant (Article 4).
Articles 5 to 14 set thresholds per type of provider. One example: a cloud service that is completely unavailable for more than 30 minutes (Article 7). Scheduled maintenance does not count.
Art. 3 to 14 Implementing Regulation (EU) 2024/2690 · Art. 23(3) NIS 2
How it relates to the German BSIG
For the eleven types of provider, the regulation takes precedence over the measures in § 30 BSIG (§ 30(3) BSIG).
It does not apply to any other company. Their measures are measured against § 30 BSIG. The Commission has not yet adopted an implementing act for all entities (§ 30(4) BSIG).
Under § 44(2) BSIG, the BSI's IT-Grundschutz counts as meeting § 30 only for federal administration bodies. For companies it can structure the work, but it is not evidence recognised by law.
§ 30(3) and (4) · § 44(2) BSIG
What this means for a company with 50 to 150 employees
Most companies of this size, such as manufacturers, food businesses or waste firms, belong to none of the eleven types. The regulation does not bind them. They measure their measures against § 30 BSIG.
You can read the regulation as a reference if you want to see what a measure looks like in detail. That is not a duty.
If your company is an IT service provider that runs or manages its customers' systems, however, it may be a managed service provider. Then the regulation applies to you directly.
An example
Two made-up companies with 90 employees each.
A packaging machine manufacturer: machinery manufacturing is listed in Annex 2 of the BSIG, so the company is an important entity. The regulation does not bind it. It reviews its security policy at an interval it sets itself.
An IT service provider that runs servers, networks and workstations for 200 customers: it is a managed service provider. The regulation applies to it directly.
For the IT service provider this means, among other things: management reviews the security policy at least once a year, the risk assessment is reviewed at least once a year, and access to its systems uses multiple factors where appropriate.
If it has an incident, it checks the thresholds in Articles 3 and 10 of the regulation before deciding whether to report.
How the walkthrough does this
The walkthrough at nisd2.eu covers what the BSIG asks of every entity, and it knows the providers the regulation applies to.
Each of the ten areas in § 30(2) BSIG becomes at least one step that you fill in.
The security policy step says that, for the providers the regulation applies to, the policy is reviewed at least once a year.
If your company is recorded in digital infrastructure, ICT service management or digital providers, every requirement stays open for you with the regulation's details, even once the walkthrough has done the part every entity owes.
At the end, management approves the documents in the app, signed in with its own account.
Common questions
What is CIR 2024/2690?
Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024. For eleven types of digital provider it sets the technical and methodological requirements of the measures in Art. 21(2) NIS 2 and specifies when an incident at them is significant.
Does the regulation apply to my company?
Only if it is one of the eleven types in Article 1, such as cloud, data centre or managed services, and falls under NIS2 under the national law. It does not apply to anyone else.
Does the regulation have to be transposed into national law?
No. As a regulation it applies directly in every EU country. In Germany the BSIG gives it precedence for the relevant providers (§ 30(3) BSIG).
How many sections does the Annex have?
13. They follow points (a) to (j) of Art. 21(2) NIS 2. Access control (no. 11), for example, contains multi-factor authentication (no. 11.7).
Is an ISO 27001 certificate enough?
The regulation draws on ISO/IEC 27001 and 27002, among others (recitals). A certificate does not replace its requirements, though. Check each requirement of the Annex on its own.
Sources
- Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024, OJ L, 2024/2690, 18 October 2024, EUR-Lex
- Directive (EU) 2022/2555 (NIS 2), Art. 21 and 23, EUR-Lex
- BSI Act (BSIG) §§ 28, 30, 44, gesetze-im-internet.de/bsig_2025
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Risk Management
Write the security policy
A short policy that management approves.
Authentication & Communications
Record where a second factor protects
For each program on your list: password alone, or with a second factor.
Supply Chain Security
Write down who works for you
A list of your suppliers and service providers.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
