Commission Implementing Regulation (EU) 2024/2690: Cybersecurity Measures and Significant-Incident Thresholds

Relevant entities

The covered DNS, TLD registry, cloud, data-centre, CDN, managed-service, managed-security-service, online platform, search-engine, social-networking-platform, and trust-service entities identified in Recital (1).

Proportionality

Recital (4) says account should be taken of criticality, risk exposure, size and structure, and incident likelihood, severity, and societal and economic impact.

Compensating measures

Where requirements cannot be implemented due to size, Recital (5) says entities should be able to use suitable alternatives that achieve the purpose of the requirements.

Risk treatment plan

A plan that entities should establish, implement, and monitor as part of their risk management framework; it may identify and prioritise treatment options and measures.

Asset inventory

A record of tangible and intangible assets that supports classification, tracking, lifecycle protection, risk analysis, and business continuity.

All-hazards approach

An approach protecting network and information systems and their physical environment from cyber, physical, environmental, utility, human, and natural threats.

When is a relevant entity 'aware' of a significant incident according to recital (31)?

When, after the initial assessment, it has a reasonable degree of certainty that a significant incident has occurred.

What is Article 3(1)(a)'s financial-loss threshold?

Direct financial loss that exceeds EUR 500,000 or 5% of total annual turnover in the preceding financial year, whichever is lower.

What three conditions must Article 4 recurring incidents meet?

They occurred at least twice within 6 months; they have the same apparent root cause; and they collectively meet Article 3(1)(a).

What is the Article 5 complete-unavailability threshold for DNS resolution?

A recursive or authoritative domain name resolution service is completely unavailable for more than 30 minutes.

What is the Article 7 cloud limited-availability test?

More than 5% of Union users or more than 1 million Union users, whichever number is smaller, for more than one hour.

What physical-security event independently qualifies under Article 8?

Physical access to a data centre operated by the provider is compromised.

Policy review frequency

The policy is reviewed and, where appropriate, updated by management bodies at least annually and when significant incidents or significant changes to operations or risks occur. The result is documented.

Residual risk

Risk assessment results and residual risks are accepted by management bodies or, where applicable, authorised accountable persons, provided adequate reporting to management bodies is ensured.

Monitoring automation

To the extent feasible, monitoring is automated and continuous or periodic, subject to business capabilities, while minimising false positives and false negatives.

Incident response stages

Containment to stop spread; eradication to stop continuation or recurrence; and recovery where necessary.

Business impact analysis

It assesses the potential impact of severe disruptions to business operations and supports continuity requirements for network and information systems.

Supplier registry

A current registry of direct suppliers and service providers, including contact points and the ICT products, ICT services, and ICT processes each provides.

Acquisition lifecycle

For critical components, entities shall set and implement processes to manage acquisition risks from suppliers or service providers throughout the ICT service or product life cycle, based on point 2.1 risk assessment.

Patch exception

An entity may choose not to apply a patch only when its disadvantages outweigh cybersecurity benefits. It shall duly document and substantiate the reasons.

Segmentation rule

Systems shall be segmented into networks or zones according to the point 2.1 risk assessment, and the entity's systems and networks shall be segmented from third parties' systems and networks.

Awareness audience

Employees, including management bodies, and direct suppliers and service providers must be aware of risks, informed of cybersecurity importance and apply cyber-hygiene practices.

Cryptographic agility

Protocols, algorithms, cipher strength, solutions and usage practices are approved and required following, where appropriate, a cryptographic agility approach.

Annual personnel review

Assignments of personnel to the roles in point 1.2, and their human-resource commitment, shall be reviewed at planned intervals and at least annually, then updated where necessary.

Need-to-know

An access-right principle required by point 11.2.2(a). Rights are assigned and revoked based on the information or system access needed for the relevant role or task.

Least privilege

An access-right principle required by point 11.2.2(a). Access should not exceed what is needed for the authorised purpose.

Separation of duties

An access-right principle required by point 11.2.2(a). Duties and access should be arranged so that incompatible actions are not concentrated without appropriate separation.

Shared identity

An identity assigned to multiple persons. Point 11.5.3 permits it only where necessary for business or operational reasons and subject to explicit approval and documentation.

System administration account

A specific account used exclusively for system administration operations. It must only be used to connect to system administration systems.

Continuous authentication mechanism

An alternative to multiple authentication factors in point 11.7.1, where appropriate and in accordance with the classification of the asset to be accessed.