How to comply with article 17 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 17 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 17 organises cooperation between the EU and third countries at institutional level (Cooperation Group, CSIRTs network, EU-CyCLONe). It creates no direct obligation for your entity, but it exposes an operational trap that is often overlooked: your critical subcontractors and your incident response flows regularly cross non-EU borders (US cloud hosts, offshore SOC providers, non-European detection vendors). During an inspection, the ILR checks that your incident response chain stays compliant with Union data protection law, including when you share indicators of compromise or logs containing personal data with a non-EU provider. Failing this cross-compliance between NIS 2 and GDPR exposes an essential entity to sanctions of up to 10 million EUR or 2 percent of worldwide turnover.The transfers hidden in your incident responseThe text requires every international agreement to comply with Union data protection law. In practice this requirement flows down into your operations as soon as you share security artefacts across borders. Points to verify:Your logs and network captures sent to a SOC or MDR based outside the EU often contain IP addresses, identifiers and personal data subject to the GDPR.Sharing indicators of compromise with a US threat intelligence vendor may constitute an unframed non-EU transfer.The absence of a TIA (transfer impact assessment) and of post Schrems II safeguards on these security flows is a frequent blind spot.The Data Privacy Framework (2023) only covers self-certified US entities: each provider must still be verified individually.Your incident notification clauses to the ILR must not force you to disclose data to a non-compliant third party.How Luxgap automates this riskOur Luxgap CrossBorder Incident Guard makes uncontrolled sharing of security data to a non-compliant third country impossible. The tool maps your incident response data flows in real time by connecting to Microsoft Defender, Azure Sentinel, CrowdStrike, Wazuh and to your SOC or MDR contracts stored in Odoo or M365, to identify the real geographic destination of each log, IOC and incident ticket.Automatically detects each security data flow leaving the EU as soon as a Sentinel, Defender or CrowdStrike connector routes logs to a non-European cloud region.Classifies each detection or threat intelligence provider by country of establishment and by status under the 2023 Data Privacy Framework.Generates the prefilled TIA for each transfer linked to incident response, aligned with EDPB post Schrems II recommendations.Alerts via instant Teams message whenever a new SOAR playbook or export flow sends data to the United States or a third country without safeguards.Produces a timestamped PDF report, enforceable before the ILR during an inspection, demonstrating cross-compliance between NIS 2 and Union data protection law.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a persona...

International cooperation

They trust us

Before we chat