{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2024/2690 — Implementing act — Cybersecurity risk-management measures [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/2","url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/2","title":"Article 2 — Technical and methodological requirements","family":"l2_unit_view","work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","view_of":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"Commission Implementing Regulation (EU) 2024/2690, OJ L, 2024/2690, 18.10.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng","valid_from":"2024-11-07","valid_until":null,"content_id":"cc80715d043e7216","versions":["2024-11-07"],"version_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/2/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/2/versions/2026-10-26/rev/cc80715d043e7216","versions_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/2/versions","relations_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/2/relations","act_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures#art-2","source_line":"Commission Implementing Regulation (EU) 2024/2690 · binding · OJ L, 2024/2690, 18.10.2024 · dated 17 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-17","published_on":"2024-10-18","entry_into_force":"2024-11-07","locators":{"document_date":"CELLAR 32024R2690 work_date_document","published_on":"CELLAR 32024R2690 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R2690 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","name":"Commission Implementing Regulation (EU) 2024/2690","number":"2024/2690","celex":"32024R2690","title_official":"COMMISSION IMPLEMENTING REGULATION (EU) 2024/2690 of 17 October 2024 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers (Text with EEA relevance)","document_date":"2024-10-17"},"position":{"kind":"article","key":"2","index":2,"articles":16,"annexes":1},"prev":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/1","key":"1","title":"Article 1 — Subject matter"},"next":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/3","key":"3","title":"Article 3 — Significant incidents"},"act_anchor":"#art-2"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures.md","unit_text_sha256":"fe583cec34f8f9fde7b5a7080d38a09b9c0174469a485e5f346f9f76177d84e7","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/art-2","kind":"article","key":"2","heading":"Article 2 — Technical and methodological requirements","text":"## <a id=\"art-2\"></a>Article 2 — Technical and methodological requirements\n\n1. <a id=\"art-2-p-1\"></a>For the relevant entities the technical and methodological requirements of cybersecurity risk-management measures referred to in Article 21(2), points (a) to (j), of Directive (EU) 2022/2555 are set out in the Annex to this Regulation.\n\n2. <a id=\"art-2-p-2\"></a>The relevant entities shall ensure a level of security of network and information systems appropriate to the risks posed when implementing and applying the technical and methodological requirements of cybersecurity risk-management measures set out in the Annex to this Regulation. For that purpose, they shall take due account of the degree of their exposure to risks, their size and the likelihood of occurrence of incidents and their severity, including their societal and economic impact, when complying with the technical and methodological requirements of cybersecurity risk-management measures set out in the Annex to this Regulation.\n\n    Where the Annex to this Regulation provides that a technical or methodological requirement of a cybersecurity risk-management measure shall be applied ‘where appropriate’, ‘where applicable’ or ‘to the extent feasible’, and where a relevant entity considers it not appropriate, not applicable or not feasible for the relevant entity to apply certain such technical and methodological requirements, the relevant entity shall in a comprehensible manner document its reasoning to that effect.\n\n","marks":[],"text_hash":"fe583cec34f8f9fde7b5a7080d38a09b9c0174469a485e5f346f9f76177d84e7","revision":1}}