NIS2, DORA, CIR 2024/2690: what the law actually asks — and what your platform has to prove
Three European texts now name managed SOC providers as a regulated class in their own right, put a clock on incident classification for financial entities, and set out monitoring and logging duties in the language a verdict layer is built to evidence. The precise wording, the dates, and what is vendor folklore.
Integration scope: Seculogik uses a source-agnostic architecture to ingest security alerts and events through its own data map. Wazuh and OpenSearch are the first integrations. Other named sources describe planned connector targets; their availability must be confirmed for each evaluation.
If you run a managed SOC in Europe, you are now a regulated entity yourself — with a 24-hour clock, a 72-hour clock and sanctions that scale with your turnover. Here is the actual wording, the actual dates, and which parts of what you have been told are vendor folklore.
NIS2 names you
Directive (EU) 2022/2555 — NIS2 — widens the set of regulated entities sharply and, in Annex I, explicitly includes ICT service management (business-to-business). Managed security service providers are not merely vendors to regulated entities; they are regulated entities. Article 23 sets the reporting rhythm: a 24-hour early warning, a 72-hour notification, a final report within a month. Article 34 sets sanctions that scale with turnover, and they are heavier for essential entities than for important ones.
The trap is transposition. As of this writing France has no operational NIS2 regime in force — the loi résilience is unpromulgated, and the Commission has begun infringement action against several member states over the delay. What French entities are preparing against is ANSSI's Référentiel Cyber France and the MonEspaceNIS2 portal. Any vendor telling you the French law is live is wrong; any vendor telling you to wait is also wrong, because the referential is what the audit will use.
CIR (EU) 2024/2690 makes monitoring a legal obligation, and names MSSPs directly
The strongest citation for what a security operations platform must do is not analyst commentary. It is Commission Implementing Regulation (EU) 2024/2690, which applies directly to managed security service providers and legally mandates procedures and tools "to monitor and log activities on their network and information systems to detect events" — covering traffic, user lifecycle, authentication, all privileged access, configuration and backup access — and requires that logs be retained and "protected from unauthorised access or changes."
That is a binding legal requirement to monitor, detect and protect the record, naming MSSPs as the regulated class. One caution: the regulation sets no retention period. The six-to-twelve-month figures circulating in vendor decks are vendor claims, not law.
Collecting the logs is the part you have already solved. The regulation asks for something harder: that activity is monitored, that events are detected, and that the record is protected from change. It names six classes of activity, so a hole in your detection coverage stops being an engineering backlog item and becomes an audit finding.
That is the layer Seculogik adds on top of the stack you already run, and it replaces none of it. We read from open-source SIEM and data stacks such as ClickHouse, Elastic / ELK, OpenSearch and Wazuh, and from the market platforms already in your estate: Splunk, Microsoft Sentinel, CrowdStrike, Microsoft Defender, SentinelOne, Cortex XDR, Fortinet, Okta, Entra ID, AWS and Azure. If a source is not on the list, we build the connector — or you push events through the generic webhook and map them once.
DORA's clock starts at classification
Regulation (EU) 2022/2554 — DORA — already applies to financial entities, with no transition. Its clock runs four hours from the moment an incident is classified as major.
Note the asymmetry with NIS2. NIS2's clock starts at awareness; DORA's starts at classification. Classification therefore has to be fast and evidenced: the four hours begin the moment a verdict says major, and the decision trace proves when that verdict was reached.
Which is where the vocabulary has to be exact. A case is a queue item: triaged, owned, and most often closed as a false positive. An incident is a legal object with a notification duty attached. Most cases never become one.
Deciding which ones do starts the clock — often a tier 1 analyst's call, at three in the morning, with the queue filling. So the case has to reach them already carrying a verdict, the business impact behind it, and a timestamp on both.
When the regulator asks, the answer is already written
DORA gives you four hours from classification. That is survivable only if classification happens by itself, with the evidence recorded as it happens. Deduplication and correlation turn the alert flood into a short list of qualified cases, each classified, timestamped and explained.
Seculogik then produces the artefacts a regulator or an auditor actually asks for: scorecards for NIS2 and DORA alongside NIST CSF, ISO 27001 and GDPR (the SOC Reporting module), and evidence packs that label each control implemented, gap or insufficient — and say on their own cover that they are a self-assessed coverage signal, not an attestation.
Underneath them: a tamper-evident audit trail; SLA clocks that record acknowledgement and resolution, the two timestamps MTTR is computed from; and a decision trace that records when a case was classified, on what evidence, and what would have changed the outcome.
That last one is the difference between a report and a defence. When a regulator or an auditor asks why an incident was called major four hours in, the answer is already written down, with a timestamp nobody edited afterwards.
We do not file with the authority for you, and we never will. The legal act belongs to the entity carrying the liability, and a tool that looks like it has filed on your behalf is a tool that lets a report go unfiled. So the line is drawn deliberately: you get the classification, the evidence and the timestamps; the notification stays with you.
The Cyber Resilience Act binds the vendor too
Regulation (EU) 2024/2847 — the CRA — turns its reporting obligations on manufacturers on 11 September 2026: actively exploited vulnerabilities and severe incidents must be reported to ENISA and the national CSIRT with a 24-hour early warning. Full essential requirements and CE marking follow on 11 December 2027.
This binds Seculogik as a manufacturer, not only the entities we sell to. It is why every release ships with a software bill of materials, a published coordinated vulnerability disclosure policy, and updates that are cryptographically signed, applied only by your administrator, and rolled back automatically if the platform fails its own health check.
What you can put in front of an auditor
We hold no ANSSI qualification, no CSPN, no SecNumCloud, and we will not imply otherwise — a readiness assessment is on our roadmap, a claim is not. It is worth checking any qualification claim against the ANSSI catalogue yourself, and remembering that running on a qualified host is not the same as being qualified. Apply that test to every vendor on your shortlist, including us.
Sovereignty is table stakes, not a product. It is why a European MSSP that cannot ship customer telemetry to a US model endpoint can use us at all; it is not what would make them stay. What should is that the backlog gets smaller and every case arrives with the reasoning already written down.
So here is what you can put in front of an auditor today, on Seculogik. The telemetry stays on your own infrastructure by default. The AI analyst — SIROC, the Advanced AI module — runs on your own box unless an administrator turns on a cloud key.
What does leave is redacted first and recorded on a ledger nobody can edit. Every decision carries a timestamped trace. And the vendor behind the platform is a European entity bound by the same regulations you are.
Deadlines are met by classification, not by paperwork. The next chapter is the machinery that produces it: see how Seculogik works — alerts → cases → decisions — and what is already written down by the time the clock starts.