We present an initial work of how Security Operations Centers (SOCs) can align rapid incident response with the compliance demands of the NIS2 Directive. Building on the existing SAPPAN reference architecture for cyber threat intellegence (CTI) exchange and automation, this work identifies gaps in auditability and traceability and takes first steps toward integrating regulatory requirements into SOC collaboration models.