Cybersecurity firm · NIS 2 · DORA · ISO 27001
Cybersecurity in Luxembourg: audit and penetration testing.
Luxgap is an independent Luxembourg cybersecurity firm based in Kahler. Three teams work side by side: lawyers (NIS 2, DORA, GDPR, AI Act), IT security engineers (audits, penetration tests, dark web monitoring) and developers (custom tools, integration). Our market: Luxembourg and the neighbouring border regions of Belgium, France and Germany.
What does a cybersecurity audit in Luxembourg cover?
An assessment against a reference framework: most often ISO 27001, or the risk-management measures in Article 21 of the NIS 2 Directive (security policies, incident handling, business continuity, supply chain security, access control, multi-factor authentication and more). You get the gaps ranked by severity and an action plan prioritised by actual risk.
The formats, from the compliance audit to the Microsoft 365 or Google Workspace configuration review, are described on our cybersecurity audit and penetration testing page.
The formats, from the compliance audit to the Microsoft 365 or Google Workspace configuration review, are described on our cybersecurity audit and penetration testing page.
When should you call in a cybersecurity provider?
Four situations come up again and again: ahead of a deadline (a client, an investor or a tender asks for proof of security, or you are aiming for ISO 27001 certification); when a law applies to you (NIS 2, DORA, GDPR) and you have to show the measures you have taken; after a major change (cloud migration, a new internet-facing application, a merger); and during or after an incident, to qualify it, contain it and document it.
For an incident, we can also step in without a prior mandate, as a one-off engagement.
For an incident, we can also step in without a prior mandate, as a one-off engagement.
Which cybersecurity obligations apply in Luxembourg?
Three EU texts set most of the rules. The GDPR requires personal data to be kept secure (Article 32) and breaches that are likely to result in a risk to be notified to the CNPD, in principle within 72 hours (Article 33). The NIS 2 Directive (EU) 2022/2555 covers essential and important entities in the sectors it lists: risk-management measures (Article 21), approval and training by management bodies (Article 20), and reporting of significant incidents, starting with an early warning within 24 hours (Article 23). The DORA Regulation (EU) 2022/2554 has applied to the financial sector since 17 January 2025.
The authorities: the CNPD for personal data, the ILR for NIS 2, the CSSF for the financial sector. The scope of NIS 2 is set out on our NIS 2 in Luxembourg page.
The authorities: the CNPD for personal data, the ILR for NIS 2, the CSSF for the financial sector. The scope of NIS 2 is set out on our NIS 2 in Luxembourg page.
What cybersecurity does a Luxembourg fiduciary need?
A fiduciary holds personal data and confidential client documents: accounts, contracts, identity papers. The GDPR applies in every case, with the duty to secure that data (Article 32) and to notify the CNPD of breaches that are likely to result in a risk (Article 33). If the firm is supervised by the CSSF, sector requirements come on top.
The first things to check: multi-factor authentication on email and client portals, the Microsoft 365 or Google Workspace configuration, tested backups, and phishing awareness for staff. An initial audit shows what is missing in your firm.
The first things to check: multi-factor authentication on email and client portals, the Microsoft 365 or Google Workspace configuration, tested backups, and phishing awareness for staff. An initial audit shows what is missing in your firm.
Which cybersecurity services do you offer?
Cybersecurity audit and penetration testing: an ISO 27001 or NIS 2 assessment, tests on your applications, a re-test after fixes.
Outsourced CISO: security run over time, governance and incidents included.
Dark web monitoring: leaked credentials, lookalike domains, mentions of your brand.
Counter-espionage: sweeps of sensitive premises, including detection of rogue Wi-Fi networks installed without your knowledge.
Business continuity and awareness: continuity planning, sessions for executives and staff.
Outsourced CISO: security run over time, governance and incidents included.
Dark web monitoring: leaked credentials, lookalike domains, mentions of your brand.
Counter-espionage: sweeps of sensitive premises, including detection of rogue Wi-Fi networks installed without your knowledge.
Business continuity and awareness: continuity planning, sessions for executives and staff.
How is a cybersecurity quote put together?
From your real scope: size of the organisation, sector, applicable laws (NIS 2, DORA, GDPR), current maturity, the applications and sites to test. The quote is itemised, dated and lists its deliverables, whether for a one-off audit, a penetration test, an outsourced CISO mandate or continuous monitoring. You configure it online and receive a proposal within 24 business hours.
Build my quote →
Build my quote →
Let's talk about your situation.
Quote within 24 business hours. No commitment, no sales pressure.