NIS2 Article 17: Your Vendor Contracts Just Got a Compliance Makeover

Article 17: The Hidden Gem of NIS2

If you thought NIS2 was just about reporting incidents and board accountability, think again. Article 17 has quietly emerged as a game-changer for how companies engage with cyber service providers like SOCs, MDRs, penetration testers, and threat intelligence firms. The Italian cybersecurity authority (ACN) has released FAQs that shed light on this provision, and the implications are immediate.

Featured Snippet Bait: What does NIS2 Article 17 require? It mandates that companies formalize agreements with cyber service providers for the exchange of sensitive information and notify authorities of these arrangements. This affects SOC, MDR, penetration testing, and threat intelligence contracts.

What Article 17 Actually Says

Article 17 of the NIS2 Directive requires essential and important entities to adopt measures to manage cybersecurity risks, including policies on the use of cryptography and, where appropriate, encryption. But the ACN FAQs zoom in on a specific aspect: the obligation to have formal agreements with providers of cybersecurity services that involve access to sensitive information.

Think of it like this: you wouldn't let a plumber into your house without a contract specifying what they can touch, right? Well, now the law says you need a written agreement with your cyber plumber—detailing what data they access, how they handle it, and what happens if something goes wrong.

Practical Impacts on Your Contracts

If you're using a SOC, MDR, or any external team for penetration tests or threat intelligence, you need to check your contracts. The ACN FAQs clarify that these agreements must include:

• Clear scope of services and data access
• Data protection and confidentiality clauses
• Incident notification procedures
• Termination and data return/deletion terms

And here's the kicker: you must communicate these agreements to the competent authority (in Italy, that's ACN). Failure to do so could result in penalties. So, dust off those contracts—or better yet, call your legal team.

Why This Matters Now

NIS2 transposition deadlines are looming (October 2024 for EU member states). Italy has already started enforcement, and other countries will follow. Article 17 is not just a bureaucratic checkbox; it's about ensuring that your cyber defenses are built on solid legal ground. Without proper agreements, you might be exposing sensitive data without adequate safeguards.

As one compliance officer put it: "Reading through Article 17 requirements is about as fun as cleaning grout with a toothbrush, but ignoring it could cost you a lot more than a sore arm."

Steps to Take Today

First, inventory all your cyber service providers. Second, review existing contracts against the ACN FAQs. Third, draft or amend agreements to include the required clauses. Finally, notify the authority. It's a bit of work, but think of it as spring cleaning for your cybersecurity posture.

For the full text of the NIS2 Directive, see EUR-Lex: Directive (EU) 2022/2555.

FAQ