ILR CP/N26/1: Evidence your NIS 2 measures with an ISO 27001 ISMS

Excerpt — On 6 July 2026, the ILR opened consultation CP/N26/1 on the draft regulation governing the notification of “security measures” by essential entities. Here is how an ISO 27001 ISMS helps you respond, document, and notify with confidence.

The facts

On 6 July 2026, the Institut Luxembourgeois de Régulation (ILR) launched a public consultation CP/N26/1 on a draft regulation regarding the notification of security measures implemented by essential entities. The consultation is open until 6 August 2026 and the draft sets out the expected content and format for this recurring notification of measures in place (ILR — CP/N26/1). At the same time, the ILR publicly recalls the entry into force of the law of 5 May 2026 transposing NIS 2 in Luxembourg, as well as the obligation of early warning within 24 hours in case of a significant incident (ILR — Presentation of the NIS 2 law and Incident notification portal). For practical guidance, see our page on NIS 2 in Luxembourg.

Beyond incident reporting, the ILR is setting up a framework to collect and assess the risk management measures implemented by essential entities (and, by extension, important entities when an equivalent text is released). This implies being able to describe your measures, map them to NIS 2 requirements, evidence their deployment and maturity, and then notify in the expected format.

The applicable legal framework

• NIS 2 — Article 21: obligation for entities to implement proportionate cybersecurity risk-management measures (governance, policies, vulnerability management, access control, supply chain security, logging, monitoring and response, etc.). Expectations must be evidenced to the competent authority.
• Luxembourg — Law of 5 May 2026: transposes NIS 2 and designates ILR as the competent authority for most sectors, with incident notification within 24h and a SERIMA portal for submissions (ILR — NIS 2, ILR — Incident notification).
• ILR draft regulation CP/N26/1: formalises the periodic notification of security measures by essential entities — a burden of proof for implementing Article 21 (consultation open 06/07–06/08/2026, source).

Reference text: Directive (EU) 2022/2555 (NIS 2) — EUR‑Lex.

The technical solution to deploy: a certified ISO 27001 ISMS

To meet the requirement for evidencable and notifiable measures, implementing (and ideally certifying) an ISO/IEC 27001:2022 ISMS is the most direct and industrialised path. To accelerate locally, see ISO 27001 certification in Luxembourg. Why?

• Governance and evidence: approved policies, defined roles and responsibilities, formalised risk management, and a Statement of Applicability (SoA) justifying each control — immediately reusable for ILR notification.
• Technical and organisational controls: alignment with Annex A (93 controls): asset inventory (A.5.9), vulnerability management (A.8.8), logging and monitoring (A.8.16), access control (A.5.15–A.5.18), supplier security (A.5.19–A.5.22), continuity (A.5.30–A.5.36), etc. These families align with NIS 2 Article 21.
• PDCA cycle: the Plan–Do–Check–Act loop ensures continuous improvement, useful to demonstrate expected maturity and explain gaps and action plans in the notification.
• Framework interoperability: easy crosswalks with NIST CSF 2.0 (Identify–Protect–Detect–Respond–Recover) and CIS Controls v8, helpful to complete technical annexes.

Standard reference: ISO/IEC 27001:2022 (ISO). Legal framework: NIS 2 — Article 21.

How Luxgap deploys this

• Our ISO 27001 governance: our Lead Implementer/Lead Auditor consultants scope the perimeter, build the risk map, draft the SoA and policies, and set up a quarterly control plan. We prepare for certification with dry runs and a traceable corrective action register.
• Our managed SOC (optional depending on scope): if you select A.8.16 (monitoring) controls, we operate 24/7 detection, logging and reporting to feed both Article 23 (24/72h incidents) and the “measures in place” part of CP/N26/1 notification.
• Our outsourced DPO and CISO consultants: we provide compliance leadership (risk committees, KPIs, management reviews) and produce the deliverables expected by ILR (measure sheets, evidence, improvement plans) in the required format.

Real-world case in Luxembourg or the EU

A local fiduciary, classified as an essential entity, needed to structure its measures before CP/N26/1 opened. In 6 weeks, we:

1. Defined the ISMS scope (critical IS, key suppliers) and performed a risk assessment aligned to NIS 2 Art. 21.
2. Established a SoA mapped to ISO 27001 Annex A and to the sections of the CP/N26/1-targeted “security measures” template.
3. Implemented three priority controls: vulnerability management (monthly tooled cycle), logging/SIEM (NIS 2 use cases) and supplier security (clauses and reviews).
4. Produced the notification file ready for submission (evidence, KPIs, remediation plans), reusable for annual reviews and for incident response (Article 23) via SERIMA.

Result: a compelling dossier and a durable foundation for future notification iterations, with metrics consolidated by the executive committee.

First concrete steps

1. Identify the essential scope: services/assets under NIS 2, critical dependencies and major suppliers. Make a short, sourced list.
2. Run a “light” risk assessment in 10 days: realistic scenarios, risk levels, existing measures, gaps vs Art. 21.
3. Draft a provisional SoA (ISO 27001 Annex A): justify each control (applied/not applied) and plan milestones for implementation.
4. Prioritise 3 high-impact controls: vulnerability management, logging/monitoring, access security (phishing-resistant MFA if external accounts).
5. Prepare the CP/N26/1 notification package: measure sheets, evidence (signed policies, log excerpts, scan reports), 90‑day improvement plan, coordination contact.

Official sources

• ILR — CP/N26/1: “security measures” consultation (06/07/2026 → 06/08/2026)
• ILR — Cybersecurity: ILR presents the new NIS 2 law (July 2026)
• ILR — Incident notification (NIS 2: early warning 24h, notification 72h)
• EUR‑Lex — Directive (EU) 2022/2555 (NIS 2), Art. 21
• ISO — ISO/IEC 27001:2022