{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2024/2690 — Implementing act — Cybersecurity risk-management measures [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/4","url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/4","title":"Article 4 — Recurring incidents","family":"l2_unit_view","work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","view_of":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Implementing Regulation (EU) 2024/2690, OJ L, 2024/2690, 18.10.2024","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng","valid_from":"2024-11-07","valid_until":null,"content_id":"e273906fad579dfe","versions":["2024-11-07"],"version_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/4/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/4/versions/2026-10-26/rev/e273906fad579dfe","versions_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/4/versions","relations_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/4/relations","act_url":"https://www.headlesslaw.com/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures#art-4","source_line":"Commission Implementing Regulation (EU) 2024/2690 · binding · OJ L, 2024/2690, 18.10.2024 · dated 17 Oct 2024 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"implementing_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2024-10-17","published_on":"2024-10-18","entry_into_force":"2024-11-07","locators":{"document_date":"CELLAR 32024R2690 work_date_document","published_on":"CELLAR 32024R2690 official-journal-act_date_publication","entry_into_force":"CELLAR 32024R2690 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures","name":"Commission Implementing Regulation (EU) 2024/2690","number":"2024/2690","celex":"32024R2690","title_official":"COMMISSION IMPLEMENTING REGULATION (EU) 2024/2690 of 17 October 2024 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and further specification of the cases in which an incident is considered to be significant with regard to DNS service providers, TLD name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, providers of online market places, of online search engines and of social networking services platforms, and trust service providers (Text with EEA relevance)","document_date":"2024-10-17"},"position":{"kind":"article","key":"4","index":4,"articles":16,"annexes":1},"prev":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/3","key":"3","title":"Article 3 — Significant incidents"},"next":{"path":"/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/articles/5","key":"5","title":"Article 5 — Significant incidents with regard to DNS service providers"},"act_anchor":"#art-4"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_impl/2024/2690/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures.md","unit_text_sha256":"c01fd9c9abc8316cc4db88071d62387ab4cf2b2e16b1014a2d715ee88d78bb1d","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/nis2/level-2/implementing-acts/2024-2690-cybersecurity-risk-management-measures/art-4","kind":"article","key":"4","heading":"Article 4 — Recurring incidents","text":"## <a id=\"art-4\"></a>Article 4 — Recurring incidents\n\nIncidents that individually are not considered a significant incident within the meaning of Article 3, shall be considered collectively as one significant incident where they meet all of the following criteria:\n\n<a id=\"art-4-p-a\"></a>**(a)** they have occurred at least twice within 6 months;\n\n<a id=\"art-4-p-b\"></a>**(b)** they have the same apparent root cause;\n\n<a id=\"art-4-p-c\"></a>**(c)** they collectively meet the criteria set out in Article 3(1)(a).\n\n","marks":[],"text_hash":"c01fd9c9abc8316cc4db88071d62387ab4cf2b2e16b1014a2d715ee88d78bb1d","revision":1}}