How to comply with article 24 of NIS 2?

Question

I need to bring my Luxembourg organisation into compliance with article 24 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 24 is often read as a mere option, and that is where the trap lies. Many essential and important entities assume that a vendor displaying an ISO 27001 badge or a Common Criteria certificate automatically ticks the box. In reality, during an inspection the ILR checks that the certification relied upon corresponds to a European scheme adopted under Regulation (EU) 2019/881 (EUCC, EUCS frameworks), genuinely covers the scope of the product or service in use, and has not expired. A certificate that is out of scope, lapsed or based on a non recognised standard demonstrates nothing under Article 21, and the gap is treated as an unjustified risk management measure.Practical pitfalls on certificationConfusing a vendor attestation (a marketing self declaration) with a certification issued by an accredited body under an EUCC or EUCS scheme.Relying on a certificate whose scope statement specifically excludes the module or service you actually deploy.Failing to monitor certificate expiry dates and suspensions, which can lapse without warning on the vendor side.Overlooking the qualified trust services (signature, timestamping, electronic seal) that Member States must encourage under paragraph 1.Ignoring that a future Commission delegated act may make certification mandatory for certain categories of entities, with an implementation period to meet.How Luxgap automates this riskOur Luxgap Certification Watchtower makes the lapsed or out of scope certificate blind spot impossible: the tool fetches the real certification status of every ICT product, ICT service and ICT process in your chain by itself, with no vendor questionnaire. It cross references your asset inventory (Microsoft Defender, Azure Sentinel, CrowdStrike, your CMDB and your Odoo contracts) with the public registries of the European schemes (EUCC, EUCS) and the trusted list of qualified services, to expose what is actually certified versus what you believe you deploy.Automatically detects every active ICT product and service in your environment through Defender, Sentinel, CrowdStrike and CMDB connectors, then matches it against the certificate relied upon.Verifies for each certificate the source scheme (EUCC, EUCS, Common Criteria), the covered scope and the expiry date against the official registry.Alerts in real time on Teams as soon as a certificate is suspended, expired or its scope no longer covers the deployed module.Classifies your trust services and flags which ones are genuinely qualified within the meaning of the eIDAS Regulation, in line with the encouragement of paragraph 1.Anticipates Commission delegated acts making a product category mandatorily certified and calculates your remaining implementation window.Produces a timestamped PDF report, enforceable before the ILR during an inspection, demonstrating the justification of each certified product choice under Article 21.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending...

Use of European cybersecurity certification schemes

They trust us

Before we chat