NIS2 Implementing Regulation

With regard to providers of social networking services platforms, an incident shall be considered significant under Article 3(1)(g) where it fulfils one or more of the following criteria:

(a) a social networking service platform is completely unavailable for more than 5 % of that social networking service platform’s users in the Union, or for more than 1 million of that social networking service platform’s users in the Union, whichever number is smaller;

(b) more than 5 % of a social networking service platform’s users in the Union, or more than 1 million of a social networking service platform’s users in the Union, whichever number is smaller, are impacted by limited availability of that social networking service platform;

(c) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of a social networking service platform is compromised as a result of a suspectedly malicious action;

(d) the integrity, confidentiality or authenticity of stored, transmitted or processed data related to the provision of a social networking service platform is compromised with an impact on more than 5 % of that social networking service platform’s users in the Union, or on more than 1 million of that social networking service platform’s users in the Union, whichever number is smaller.