Recital 118
Directive on the security of network and information systems · UE 2022/2555
| (118) | Where information which is classified in accordance with Union or national law is exchanged, reported or otherwise shared under this Directive, the corresponding rules on the handling of classified information should be applied. In addition, ENISA should have the infrastructure, procedures and rules in place to handle sensitive and classified information in accordance with the applicable security rules for protecting EU classified information. |
In Luxembourg, the handling of classified information under NIS 2 is governed by the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) read together with the law of 15 June 2004 on classification of documents and security clearances. ANSIL (National Security Authority) remains competent for LUX RESTRICTED to LUX TOP SECRET clearances, while ILR receives NIS 2 notifications and mandates its own secure channels for sensitive information. Any transmission to ENISA of nationally classified information requires prior coordination with ANSIL.
Luxgap practice: we map your ILR/ENISA flows and identify upstream which transmissions require ANSIL clearance and which exact channel to use, so that a 24-hour incident notification does not turn into a breach of national defence secrecy.
