Recital 18
Digital Operational Resilience Act · UE 2022/2554
| (18) | To enable cross-sector learning and to effectively draw on experiences of other sectors in dealing with cyber threats, the financial entities referred to in Directive (EU) 2022/2555 should remain part of the ‘ecosystem’ of that Directive (for example, Cooperation Group and computer security incident response teams (CSIRTs)).The ESAs and national competent authorities should be able to participate in the strategic policy discussions and the technical workings of the Cooperation Group under that Directive, and to exchange information and further cooperate with the single points of contact designated or established in accordance with that Directive. The competent authorities under this Regulation should also consult and cooperate with the CSIRTs. The competent authorities should also be able to request technical advice from the competent authorities designated or established in accordance with Directive (EU) 2022/2555 and establish cooperation arrangements that aim to ensure effective and fast-response coordination mechanisms. |
In Luxembourg, the relevant national CSIRT for the financial sector is CIRCL (Computer Incident Response Center Luxembourg), with GOVCERT.LU for public sector entities and certain OIVs. The law of 30 July 2024 transposing the NIS 2 directive designates the ILR as the general NIS 2 competent authority, but designates the CSSF as the sectoral authority for financial entities. In practice, a bank or PSF must articulate its notifications between CSSF (eDesk channel) and CIRCL (MISP/encrypted email channel), and participate in the national Cooperation Group work led by the Haut-Commissariat a la Protection nationale (HCPN).
Luxgap practice: we configure the dual CSSF+CIRCL routing in your incident playbooks and subscribe your SOC to CIRCL MISP feeds from the scoping phase to materialise membership in the cross-sector ecosystem.
