Regulation (EU) 2024/2690, point by point, and the record Opafra writes for each.
Regulation (EU) 2024/2690 is the NIS2 implementing regulation for managed service providers, cloud computing service providers, data center service providers and others. Its annex sets technical requirements for access, changes, backups and logs. Below, each point we read at source is paired with the record that answers it, and the points Opafra answers only in part, or not at all, are listed too.
The providers Article 1 names.
Article 1 of Regulation (EU) 2024/2690 names DNS service providers, TLD name registries, cloud computing service providers, data center service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, online search engines and social networking platforms, and trust service providers. A hoster, a managed service provider or a cloud provider is named directly.
A provider is subject to the Regulation once the NIS2 law of its country makes it a regulated entity, which also depends on its size. Whether that is the case for you is a question for your own advisers.
A smaller provider can meet these points through a client rather than through the law: a client in scope puts security requirements into its supplier contracts and sends a questionnaire. The records are the same either way.
What each point asks, and the record that answers it.
Yes means a record Opafra writes answers the point, for work done through Opafra. Partly means the record is a part of the answer. The points are paraphrased; the wording is on EUR-Lex.
8 yes, 4 partly
- 6.7.2(h): connections of service providers
- Yes. The point allows connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation. A grant starts as a request with a reason, is approved by a named person and ends on its own. Every connection under it is listed with the server and the run. See the access record.
- 6.7.2(d): controls for remote access
- Partly. The point asks for controls on remote access to network and information systems, including access by service providers. The access record shows the controls applied to access that goes through Opafra: who, on whose approval, for how long. Choosing the controls, and remote access that does not go through Opafra, are yours.
- 11.2.2(c): access authorised by the relevant persons
- Yes. Each grant is approved by a named approver, who must hold access to the environment. The approval is part of the record.
- 11.2.2(d): third-party access limited in scope and duration
- Yes. Access for a supplier or a service provider is an environment grant with an end time. The record shows the scope, the window and how it ended.
- 11.2.2(e) and (f): a register of access rights, and logging of how they are managed
- Yes. The signed-off access review lists everyone with access to an environment. Every role and grant change is in the audit log, with the actor and the time.
- 11.3.3: review of privileged and administration accounts
- Yes. The point asks for a review at planned intervals, with the results documented. The access review keeps who reviewed, when, and what changed. It covers access that goes through Opafra. Accounts that exist on the servers themselves are reviewed where they live.
- 3.2.3(e): logs of privileged access and administrative activity
- Yes. Every run and the commands per host are logged, and every grant, approval and sign-in to Opafra is in the audit log. Nothing is trimmed.
- 3.2.5: keep and back up logs, protect them from changes
- Partly. The audit log is append-only: the database refuses a change or a deletion of a line. Backing it up is done by exporting it as CSV or NDJSON, or fetching it through the API, to a store you hold.
- 6.4.2: changes documented, tested and assessed before they go ahead
- Yes. A change is a plan with a revision, previewed on each host in a dry run, and run with its outcome recorded. The point does not use the word approval. The approval, bound to the revision that runs, goes beyond it and is what Opafra adds. See the change record.
- 6.4.3: emergency changes
- Partly. When the normal procedure cannot be followed, the point asks to document the result and why. The run record marks a run that its own author approved. The reason the usual procedure could not be followed is for your team to document.
- 6.6.1(a) and 6.6.2: patches in reasonable time, and the reason when one is not applied
- Partly. Patch runs and their deadlines are recorded, with the reason a server was skipped. Opafra does not scan for vulnerabilities, so it does not show which patches are missing.
- 4.2.6: regular testing of backup recovery, results documented
- Yes. A scheduled plan restores the latest backup onto a scratch host, runs a smoke test and records the result and the time it took. See the restore test. The record proves a restore. It does not show that backups are made, or how recent they are.
Evidence for a point, not a verdict.
- Work outside Opafra
- No. Opafra records what goes through it: plans, runs, grants and the sign-in to Opafra itself. Work done on a server outside Opafra is not in these records.
- Policies, risk assessments and decisions
- No. The Regulation also asks for policies, procedures and risk assessments. Those are documents your organization writes. Opafra gives the record that they were applied, not the text.
- Vulnerability scanning and detection
- No. Opafra does not scan for vulnerabilities and is not a SIEM. The audit log can be exported or fetched through the API by the system that does.
- Session recording
- No. Opening a console session is logged, with who opened it and when, but the session is not recorded.
- A verdict on the Regulation
- No. The records are evidence for the points above. They do not say that an organization meets them, and Opafra is not a certification. Whether the Regulation applies to you is a question for your own advisers.
See the records for your own servers.
Tell us what you run and which questions your clients ask. You get a demo and your price in writing within one business day, with no call.