NIS 2 Luxembourg: required security deliverables by ILR

NIS 2 Luxembourg — new security deliverables. On 3 August 2026, ILR released templates framing the annual deliverables on security measures (Art. 21 NIS 2): description of measures, scenario analysis, multi‑year action plan and, upon request, dependency list. See ILR “Security measures”. https://www.ilr.lu/en/sectors/niss/security-measures/

The case

Since the Law of 5 May 2026 (effective 10 May), ILR has been structuring NIS 2 supervision. On 3 August 2026, the Institute published standardized templates for:

• Description of measures in place
• Analysis of key cyber risk scenarios
• Multi‑year action plan
• Dependency list (upon targeted request)

These templates define the annual deliverables for essential entities; important entities are only required to provide them where there are signs of non‑compliance. ILR underlines the legal basis (Art. 12 of the Law, transposing Art. 21 NIS 2) and may require a detailed risk analysis and effectiveness evidence. https://www.ilr.lu/en/sectors/niss/security-measures/

Legal basis

• Directive (EU) 2022/2555 (NIS 2), Arts. 21 and 20. https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
• Luxembourg: Law of 5 May 2026 (ELI). https://legilux.public.lu/eli/etat/leg/loi/2026/05/05/a225/jo
• Implementing Regulation (EU) 2024/2690 and in‑scope entities. https://www.ilr.lu/en/sectors/niss/nis-2/implementing-regulation-nis2/

Legal reasoning

1) Scope of Article 21 NIS 2

• “Appropriate and proportionate” measures covering all networks and IS supporting activities, with an all‑hazards approach. The OJ clarifies: the duty covers all operations and services, not just “critical” IT assets. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AC%3A2023%3A328%3AFULL
• Ten minimum control domains (a–j): governance/risk, incident handling, continuity/backup/crisis, supply chain, SDLC + vulnerability management, effectiveness assessment, hygiene/training, cryptography, HR/access/asset management, MFA/secure communications. https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive-faqs

2) Luxembourg transposition and supervision

• The 5 May 2026 Law transposes via Art. 12. Supervision: ex ante + ex post for essential entities; ex post for important entities. Annual deliverables: description, scenario questionnaire, action plan, and—if required—dependency list. https://www.ilr.lu/en/sectors/niss/security-measures/
• Competences: ILR as general authority; CSSF for banking and certain market infrastructures, as recalled by the Commission. https://digital-strategy.ec.europa.eu/en/policies/nis2-directive-luxembourg

3) EU technical reference frameworks

• For entities under 2024/2690, the Commission/ENISA issued a technical guide with requirements, sample evidence and mappings. https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
• The NIS Cooperation Group provides a reference document on security measures. https://digital-strategy.ec.europa.eu/en/policies/nis-cooperation-group

For local orientation, see our page on NIS 2 in Luxembourg and ILR’s role and the legal overview of NIS 2 obligations.

What changes in practice

• Governance: the management body must approve and is liable for failures (Art. 20). ILR’s templates make deliverables objective, verifiable and comparable. https://digital-strategy.ec.europa.eu/en/policies/nis2-directive
• Full scope: the description covers all IS‑supported activities: IAM/MFA, 3‑2‑1‑x backups, vulnerability management, hardening, logging, testing, etc. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AC%3A2023%3A328%3AFULL
• Scenario analysis: the questionnaire standardizes supervision but does not replace your risk analysis (Art. 12). Keep evidence and show alignment. https://www.ilr.lu/en/sectors/niss/security-measures/
• Supply chain: ILR may require the dependency list for critical providers/outsourcers. Map contracts, locations, SOC relays, notification and testing clauses. https://www.ilr.lu/en/sectors/niss/security-measures/
• “Concerned entities” (cloud, DNS, MSP, etc.): apply 2024/2690 and align evidence with ENISA’s guide. https://www.ilr.lu/en/sectors/niss/nis-2/implementing-regulation-nis2/ ; https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance

To steer these workstreams, an outsourced CISO can structure governance, the asset register and the control portfolio aligned with Art. 21.

Luxembourg examples

• Essential hospital: prove phishing‑resistant MFA, OT/IoMT segmentation, asset inventory, and DLP for transfers with processors (points a, d, j). Use ENISA’s guide to build an evidence pack. https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
• MSP in scope: vulnerability management and coordinated disclosure, immutable backups, 24/7 monitoring and admin access reviews (points c, e, g, j), with effectiveness metrics. https://www.ilr.lu/en/sectors/niss/nis-2/implementing-regulation-nis2/

Common pitfalls

1. Confusing ILR’s questionnaire with internal risk analysis: it does not replace your method; ILR may request the detailed analysis and evidence. https://www.ilr.lu/en/sectors/niss/security-measures/
2. Narrowing scope to “essential services”: contrary to Art. 21(1); the duty covers all IS‑supported operations. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AC%3A2023%3A328%3AFULL
3. Overlooking the supply chain: without supplier mapping, you cannot evidence risk control or respond to targeted requests. https://www.ilr.lu/en/sectors/niss/security-measures/
4. Unprioritized action plans: they must flow from risk analysis and effectiveness assessments (Art. 21(2)(f)). ENISA’s guide gives helpful examples. https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
5. Forgetting the management body: approval/supervision required; keep minutes and KPIs. https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

Official sources

• ILR — NIS 2 (templates, regime). https://www.ilr.lu/en/sectors/niss/security-measures/
• ILR — Implementing Regulation 2024/2690. https://www.ilr.lu/en/sectors/niss/nis-2/implementing-regulation-nis2/
• ENISA — NIS2 Technical Implementation Guidance. https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance
• Commission — NIS 2 (reference and FAQs). https://digital-strategy.ec.europa.eu/en/policies/nis2-directive ; https://digital-strategy.ec.europa.eu/en/faqs/directive-measures-high-common-level-cybersecurity-across-union-nis2-directive-faqs
• OJ — clarifications on Art. 21(1). https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AC%3A2023%3A328%3AFULL
• Legilux — Law of 5 May 2026. https://legilux.public.lu/eli/etat/leg/loi/2026/05/05/a225/jo
• Commission — NIS 2 in Luxembourg (ILR/CSSF). https://digital-strategy.ec.europa.eu/en/policies/nis2-directive-luxembourg

Practical note: ILR’s 3 August 2026 templates are an evidence baseline. Align risk committees, asset register and control set with Art. 21(2)(a–j), and populate templates with effectiveness indicators. For resilience and crisis readiness, consider our business continuity and DRP support.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.