NIS2's binding technical requirements for cloud, MSP and DNS suppliers (Regulation 2024/2690)

Which suppliers it covers

The regulation does not apply to every entity under NIS2. It applies to eleven kinds of provider in three groups, and the list is worth reading closely, because two of the groups describe suppliers that almost every company now depends on.

Official source: Commission Implementing Regulation (EU) 2024/2690 — adopted 17 October 2024, applicable directly in all member states. Reviewed 13 August 2026.

Why this one is different from the rest of NIS2

NIS2 itself is a directive: it sets objectives, and each member state turns them into national law on its own timetable. That is the honest reason most supplier requirements are still negotiated rather than cited. An implementing regulation works the other way round. It applies as written, in every member state, without any national step in between. So for these eleven kinds of provider there is no transposition to wait for and no national variation to argue about, and the requirements are itemised rather than described in principle.

The thirteen requirement areas

The annex sets out thirteen areas. Read as a buyer, they divide into three kinds: the ones that leave traces on the public internet, the ones that leave partial traces, and the ones that exist only inside the supplier's organisation.

• 1Policy on the security of network and information systemsHas to be asked
• 2Risk management policyHas to be asked
• 3Incident handlingHas to be asked
• 4Business continuity and crisis managementHas to be asked
• 5Supply chain securityPartly visible
• 6Security in acquisition, development and maintenanceVisible from outside
• 7Assessing the effectiveness of the measuresPartly visible
• 8Basic cyber hygiene and security trainingHas to be asked
• 9CryptographyVisible from outside
• 10Human resources securityHas to be asked
• 11Access controlPartly visible
• 12Asset managementVisible from outside
• 13Environmental and physical securityHas to be asked

What you can verify, and what you cannot

This is the part worth being precise about, because a supplier assessment that claims more than it can see is worse than one that admits its limits. Seven of the thirteen areas cannot be observed from outside at all.

When an incident becomes notifiable

The regulation also specifies when an incident counts as significant, which is the point at which the supplier must notify its authority. The general criteria include financial loss above EUR 500 000 or five per cent of annual turnover, exfiltration of trade secrets, or death or considerable damage to health. Some provider types have their own thresholds: for DNS providers and TLD registries, for example, availability falling below 99.9 per cent, incorrect responses, or compromise of registration data. As a buyer this matters for one practical reason: it tells you what your supplier is obliged to report to a regulator, which is a useful floor for what you should expect them to report to you.

What to do with this

Frequently asked questions