I need to bring my Luxembourg organisation into compliance with recital 105 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 105 NIS 2 — Recital 105 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 105

Directive on the security of network and information systems · UE 2022/2555

(105)

A proactive approach to cyber threats is a vital component of cybersecurity risk management that should enable the competent authorities to effectively prevent cyber threats from materialising into incidents that may cause considerable material or non-material damage. For that purpose, the notification of cyber threats is of key importance. To that end, entities are encouraged to report on a voluntary basis cyber threats.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, transposes the voluntary cyber threat notification mechanism. The ILR and the national CSIRT (GOVCERT.LU for the public sector, CIRCL for the non-governmental private sector) are the contact points for these voluntary reports, which cannot result in any additional obligation or sanction solely because of the notification.

Luxgap practice: submit voluntary notifications through the MISP-LU platform operated by CIRCL, which enables automated and anonymisable IOC sharing with Luxembourg sectoral peers.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 105 sets a simple principle: detecting a cyber threat before it materialises into an incident is far better than reporting it after the fact. In practice, the ILR observes that essential and important entities passively wait for an incident to materialise (ransomware deployed, exfiltration confirmed) before acting, when they often have weak signals several days upstream. Not voluntarily reporting a serious cyber threat to the ILR or the national CSIRT, when it was known internally, considerably weakens the article 21 accountability defence during a post-incident review.

What 'voluntary notification' really means

An intrusion attempt blocked by your EDR but matching an identified APT TTP deserves escalation, not just SIEM archiving.
A targeted phishing campaign against your executives leveraging internal details (org chart, projects) signals active reconnaissance and must be shared.
A critical vulnerability exploited at a Luxembourg sectoral peer (bank, energy, healthcare) justifies a proactive report to trigger CSIRT alerts toward other entities.
An IOC observed at a subcontractor sharing your IT environment must be reported, even if your perimeter is not yet touched.
The benefit is not symbolic: the ILR shares back intelligence from the European CSIRTs network, improving your posture.

How Luxgap automates this risk

Our Luxgap Threat Signal Router turns your dormant security alerts into a qualified stream of cyber threats shareable with the ILR and the national CSIRT, without overloading your analysts. The tool continuously aggregates signals from Microsoft Defender, Sentinel, CrowdStrike, Wazuh and your firewalls, then a specialised LLM agent classifies each event against the ENISA taxonomy and decides whether it warrants voluntary notification under recital 105.

Pulls EDR, SIEM and firewall alerts in real time via API, without asking your analysts to fill in any escalation form.
Classifies each signal against the ENISA taxonomy (reconnaissance, attempted intrusion, exploitation, exfiltration) and computes a shareability relevance score.
Correlates your IOCs with MISP-LU feeds and the national CSIRT to detect whether a Luxembourg sectoral peer is already affected.
Generates a pre-filled draft voluntary notification in ILR format, anonymisable per your policy, ready for one-click validation by the CISO.
Alerts the executive committee via Teams or email when a cyber threat reaches a threshold requiring proactive reporting arbitration.
Produces a cryptographically sealed log of all detected cyber threats and the documented decision to notify or not, defensible during an ILR inspection.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real SIEM flows, with a free 48-hour blind audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 105

They trust us

Before we chat