← All articles

consultant

NIS 2 in Luxembourg: executives, mandatory training and personal risk

Under NIS 2, management bodies must approve and supervise cybersecurity measures (Art. 20), undergo regular training, and may be held personally liable for failures. The ILR has issued concrete guidance.

By Expertise Luxgap 11/05/2026

General rule

Directive (EU) 2022/2555 (NIS 2) requires “essential” and “important” entities to adopt appropriate cybersecurity risk‑management measures (Art. 21) and, crucially, assigns responsibility to the management body (Art. 20). In practice, the board or executive body must approve the measures to comply with Article 21, oversee their implementation, and may be held liable for breaches of that article. See NIS 2 Articles 20 and 21 on EUR‑Lex: eur-lex.europa.eu.

For certain digital providers (DNS/TLD, cloud, data centers, CDN, MSP/MSSP, marketplaces, search engines, social networks, trust service providers), the Commission specified technical and methodological requirements via Implementing Regulation (EU) 2024/2690 of 17 October 2024. It details risk‑management expectations and “significant incident” thresholds for these categories. eur-lex.europa.eu.

In Luxembourg, ILR is the competent NIS authority for most sectors; the CSSF covers parts of the financial sector (banks, market infrastructures) and certain digital activities under its supervision. This allocation is set out in ILR’s NIS 2 FAQ (referencing draft bill No. 8364). ilr.lu. For a local overview, see our page NIS 2 in Luxembourg.

Regulator’s position

ILR explicitly stresses “management body responsibility”: approve risk‑management measures (Art. 21), oversee implementation, and follow regular training to assess practices and their impact on services. See ILR’s page “Security measures and supervision under NIS 2” and the guide “Guidelines NIS2 – Management Bodies.” ilr.lu – ilr.lu.

On measures, ILR refers to the minimum list in Article 21(2): risk and security policies, incident handling, business continuity/disaster recovery, supply‑chain security, HR security, access control, encryption, vulnerability management, logging, etc. ilr.lu.

At EU level, ENISA provides the “NIS2 Technical Implementation Guidance” and the report “Cybersecurity roles and skills for NIS2 Essential and Important Entities,” useful to plan board and executive training. enisa.europa.eu – enisa.europa.eu.

Finally, the 2026 European debate (EDPB/EDPS) underlines that NIS 2 security controls must remain necessary and proportionate and incorporate data‑protection safeguards (notably GDPR Art. 25 – privacy by design). Ensure your board‑approved policies reflect this. edpb.europa.eu. For the legal framework overview, also see our entry on the NIS 2 directive.

How to apply in practice

Example: Luxembourg “important” group (Annex II) operating private cloud and managed services

Before (governance and scoping)

  1. Appoint an executive sponsor and an NIS 2 lead at ExCom level; formally put cybersecurity on the board agenda at least quarterly (decision traceability). Basis: NIS 2 Art. 20; ILR guide on management bodies. eur-lex.europa.eu. For operational steering, a fractional CISO can structure governance.
  2. Map the NIS 2 scope (essential vs. important entities; critical supply‑chain activities). Use ILR’s scope note. ilr.lu.
  3. Assess applicability of Implementing Regulation 2024/2690 if you provide cloud/MSSP/CDN, etc., to align technical requirements and “significant incident” thresholds. eur-lex.europa.eu.
  4. Board training plan: kick‑off then recurring sessions (at least annually) covering risks, risk appetite, supply‑chain, testing, and NIS 2/GDPR interplay. Support: ENISA “roles & skills.” enisa.europa.eu. Anchor this with structured cyber awareness.

During (measures and ongoing oversight)

  1. Approve a cyber risk‑management framework aligned with Art. 21(1): policy, risk analysis method, risk appetite, KRIs, and a multi‑year remediation plan. Board approves, management executes; regular reporting to the board. References: NIS 2 Art. 21; ILR “Security measures.” eur-lex.europa.eu – ilr.lu.
  2. Supply‑chain security: due diligence of critical suppliers, contractual cybersecurity clauses (logging, notification timelines, cooperation in investigations), targeted audits. Basis: NIS 2 Art. 21(2)(d); ENISA guidance. eur-lex.europa.eu.
  3. Detection and response capabilities: SOC/MDR, centralized logging, regular exercises (table‑top, crisis drills), tested backups; explicit coverage of subsidiaries and providers. References: NIS 2 Art. 21(2); Implementing Regulation 2024/2690 for MSSP/cloud. eur-lex.europa.eu – eur-lex.europa.eu.
  4. Incident notification procedure: early warning at 24h, notification at 72h, final report at 1 month, RACI roles, ILR/CSSF channels depending on sector, escalation scenarios. Support: ILR “Incident notification under NIS2.” ilr.lu.
  5. GDPR interplay: maintain a register for security processing (logs, detection) and conduct DPIAs if needed; check legal bases (legitimate interest/legal obligation) for telemetry and monitoring. Basis: EDPB/EDPS 2026 on proportionality. edpb.europa.eu.

After (continuous improvement and accountability)

  1. Semi‑annual board reviews on control effectiveness and risk exposure; formalize decisions (accept, mitigate, transfer). Annual director training (threat updates, incident feedback, regulatory change). Reference: NIS 2 Art. 20; ILR guide. eur-lex.europa.eu.
  2. Board‑ready traceability: minutes, risk dashboards, exercise evidence, third‑party audit reports, proof of ExCom/board training. In investigations, these are key artifacts to assess directors’ diligence. Basis: ILR “Security measures and supervision”; ENISA guidance. ilr.lu – enisa.europa.eu.

Common pitfalls

  • Confusing “delegation” with “disengagement”: the board may delegate execution, not its responsibility. NIS 2 Art. 20 mandates active approval and oversight, with potential liability for breaches of Art. 21. eur-lex.europa.eu.
  • Forgetting management training: the requirement is explicit (“must follow regular training”). ILR reiterates this in its pages and dedicated guide. ilr.lu.
  • Underestimating the supply chain: missing NIS 2 clauses in contracts (logging, cooperation in notifications, testing), while Art. 21(2)(d) and Regulation 2024/2690 strongly frame digital providers. eur-lex.europa.eu.
  • Incomplete incident procedure: no 24h early warning, 72h notification with required content, or clear escalation to ILR/CSSF by sector. ilr.lu.
  • Lack of “auditable” evidence: missing minutes, risk indicators, test/restore proof, or ExCom/board training records; in ex post supervision, this weighs on diligence assessments. Basis: ILR “Security measures and supervision.” ilr.lu.

Official sources

Practical note (May 2026)

If you are an executive in Luxembourg, treat your NIS 2 obligations as tangible: plan a structured board training before summer 2026, add approval of the cyber framework to your next board agenda, and verify applicability of Implementing Regulation 2024/2690 if you operate relevant digital services. ILR and ENISA documents above provide the regulator’s expected baselines. For local support, see NIS 2 Luxembourg.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.

expertise reglementaire nis2 luxembourg gouvernance cybersecurite ilr
LUXGAP NEWSLETTER

Get our analyses the moment they drop.

GDPR, NIS 2, AI expertise articles, plus invitations to free webinars + trainings at Luxgap. 1 to 2 emails per week max, one-click unsubscribe.

Your data is never shared. GDPR-compliant (we're DPOs after all).

A question on this topic?

Our team usually replies within one business day. Configure your quote or write to us.

Build my quote →