IR 2024/2690 3.2 Monitoring and logging
Monitoring and logging for digital infrastructure and digital provider entities: what must be logged, alarm thresholds, log protection and retention, time synchronization and redundant logging systems.
Technical and methodological requirements (Implementing Regulation 2024/2690)
Selected requirement areas from the Annex to Commission Implementing Regulation (EU) 2024/2690, which binds DNS, TLD, cloud, data center, CDN, managed and managed security service providers, online platforms and trust service providers, with ENISA's examples of evidence.
IR 2024/2690 4.2 Backup and redundancy management
Backup plans, off-network and off-site copies, integrity checks, restore testing and partial redundancy of systems, facilities, people and communication channels.
IR 2024/2690 6.3 Configuration management
Documented and enforced secure configurations for hardware, software, services and networks, for newly installed systems and across their operating life.
IR 2024/2690 6.5 Security testing
A security testing policy whose scope, frequency and test types follow the risk assessment, with documented methodology and findings, criticality ratings and mitigation of critical findings.
IR 2024/2690 6.6 Security patch management
Procedures to apply tested, integrity-checked security patches within a reasonable time, and the documented exception when patching would do more harm than good.
IR 2024/2690 6.7 Network security
Network protection, from documented architecture, remote access and time-limited supplier connections to plans for modern network protocols and email standards and DNS and routing security, alongside point 6.8 on segmentation.
IR 2024/2690 6.10 Vulnerability handling and disclosure
Collecting vulnerability information, scanning, fixing critical vulnerabilities without undue delay and running a disclosure procedure aligned with the national coordinated vulnerability disclosure policy.
IR 2024/2690 11.3 Privileged accounts and system administration accounts
Policies for privileged and administration accounts: strong authentication, dedicated admin accounts, restricted individual privileges, admin-only connections and periodic reviews, with point 11.4 on administration systems.
IR 2024/2690 12.4 Asset inventory
A complete, accurate and current inventory of operations, services, systems and supporting assets, with traceable change history, that underpins classification, logging and patching.
IR 2024/2690 13 Environmental and physical security
Physical and environmental protection under the implementing regulation: supporting utilities, physical and environmental threats with control thresholds, and perimeter and physical access control.
