The classic trap
Recital 52 illuminates DORA Article 19: reporting a major incident to the CSSF is not an isolated act, it triggers a chain of transmission to the CNPD (if personal data involved), the national CSIRT (GOVCERT.LU / CIRCL) under NIS 2, and law enforcement if the incident has a criminal nature. In practice, Luxembourg-regulated financial entities underestimate this mesh: they notify the CSSF then forget the 72-hour CNPD notification (GDPR Article 33), or ignore that Luxembourg may impose an additional direct notification to the CSIRT. The result: double sanction, loss of the CSIRT's technical advice, and breach of the cooperation expected by supervisors.
Information flows to map before the next incident
- Inbound flow: the CSSF forwards your report to the CNPD, GOVCERT.LU, possibly law enforcement, and the ESAs (EBA, ESMA, EIOPA).
- Return flow: the CSSF provides feedback and remediation guidance, the ESAs share anonymised data on threats and vulnerabilities linked to the incident.
- Parallel notification: if personal data is affected, the 72-hour CNPD notification remains due independently from the CSSF filing.
- Criminal notification: file a complaint in case of exfiltration, ransomware, CEO fraud or qualified intrusion, without waiting for CSSF closure.
- Internal coordination: DPO, CISO, COO and legal counsel must share a single view of recipients and deadlines, otherwise a channel will be missed.
The 'mutual flow' test: what the CSSF actually expects
Recital 52 emphasises the mutual nature of information circulation. In practice, during a post-incident review, the CSSF will check that you not only notified, but also received, logged and acted on feedback from authorities. An entity unable to demonstrate how it integrated GOVCERT.LU recommendations or anonymised ESA alerts into its remediation plan loses the presumption of diligence.
How Luxgap automates this risk
Our Luxgap Incident Channel Orchestrator eliminates the risk of missing a recipient authority by automatically orchestrating the full notification map during a major ICT incident. As soon as an incident is qualified in your SIEM (Microsoft Sentinel, Splunk, Wazuh, CrowdStrike) or declared manually in the console, the AI agent cross-references the incident nature (personal data affected, business criticality, potential criminal qualification, cross-border) with your regulatory profile (DORA + NIS 2 + GDPR) to produce in under 5 minutes the exact list of authorities to notify, in which order and within which legal deadlines.
- Automatically detects the triggering of a major incident by connecting to your SIEM and ITSM (ServiceNow, Jira) using DORA RTS thresholds.
- Generates pre-filled draft notifications for the CSSF (eDesk portal), the CNPD (online form), GOVCERT.LU / CIRCL and law enforcement, in FR/EN/DE versions tailored to each recipient.
- Chronologically logs every submission, acknowledgement and authority feedback with cryptographic time-stamping that is admissible as evidence.
- Centralises feedback and guidance received from authorities and turns them into remediation actions assigned in your continuity plan.
- Ingests anonymised ESA and CSIRT bulletins automatically to enrich your threat intelligence and trigger targeted checks across your systems.
- Produces a sealed post-incident PDF dossier, admissible to the CSSF, proving compliance with Recital 52 and DORA Article 19.
Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your perimeter. Request your demonstration and our teams will prepare an incident simulation on your actual perimeter, with a free 48-hour white audit to map your current notification flows before any engagement.
