I need to bring my Luxembourg organisation into compliance with recital 26 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 26 invites entities to voluntarily share significant cyber threats with CSIRTs, the ILR or the single point of contact, even when the notification obligation arises from another sector-specific act (DORA, aviation regulations, energy). In practice, essential and important entities silo themselves: they notify their sector regulator (CSSF for DORA for instance) but transmit nothing to the national CSIRT, fearing double sanction or simply unaware of the channel. The outcome: the ILR and GovCERT discover the incident through the press, and the cooperation framework envisaged by NIS 2 collapses into radio silence.What this recital changes in your governanceSharing of significant cyber threats (weak signals, IOCs, observed TTPs) is expected upstream of any incident, not only after confirmed compromise.The sharing channel with the national CSIRT is distinct from the article 23 incident notification channel: it is an additional, declarative step, not sanctionable but strongly encouraged.For entities under multiple regimes (NIS 2 + DORA, NIS 2 + aviation regulation), you must document a sharing policy that avoids duplication but ensures CSIRT, ILR and sector regulator each receive the useful information.Absence of voluntary sharing will not be sanctioned directly, but will be read as a low-maturity signal during an ILR inspection on article 21 risk management measures.How Luxgap automates this riskOur Luxgap Threat Intel Relay turns your SOC into an active contributor to the NIS 2 ecosystem without overloading your analysts. The tool intercepts IOCs, alerts and weak signals produced by your SIEM (Microsoft Sentinel, Wazuh, Splunk) or EDR (Defender, CrowdStrike), anonymises them according to the TLP grid, and routes them automatically to the relevant CSIRT and sector regulator, using the STIX/TAXII format expected by the Luxembourg GovCERT.Automatically detects indicators of compromise qualified as significant threats in your SIEM via a scoring grid aligned with ENISA guidelines.Classifies each signal under TLP:CLEAR / GREEN / AMBER protocols and applies the right level of anonymisation before transmission.Routes in parallel to the ILR, GovCERT.LU and your sector regulator (CSSF, DAC, ITM) while avoiding duplicate notifications.Generates a timestamped log of each share, defensible during an ILR inspection as evidence of cooperative maturity within the meaning of recital 26.Instantly alerts your CISO on Teams or Slack when a threat shared by a peer through the CSIRT matches an IOC present in your own environment.Available as a complement to a Luxgap CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real SIEM flows, with a free 48-hour white audit to measure your sharing maturity before any engagement.

Recital 26 NIS 2 — Recital 26 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 26

Directive on the security of network and information systems · UE 2022/2555

(26)

Where sector-specific Union legal acts require or provide incentives to entities to notify significant cyber threats, Member States should also encourage the sharing of significant cyber threats with the CSIRTs, the competent authorities or the single points of contact under this Directive, in order to ensure an enhanced level of those bodies’ awareness of the cyber threat landscape and to enable them to respond effectively and in a timely manner should the significant cyber threats materialise.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite (modifiee par la loi du 28 juillet 2025)

In Luxembourg, voluntary sharing of significant cyber threats revolves around GovCERT.LU and CIRCL (Computer Incident Response Center Luxembourg), which operate the reference MISP platform for IOC exchange between essential and important entities. The law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, designates the ILR as competent authority and single point of contact, and confirms that voluntary sharing with national CSIRTs triggers no administrative sanction.

Luxgap practice: connect your SIEM to the CIRCL MISP instance from day one of your NIS 2 onboarding, it is the historical channel recognised by the ILR and immediately materialises your cooperative posture during inspections.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 26 invites entities to voluntarily share significant cyber threats with CSIRTs, the ILR or the single point of contact, even when the notification obligation arises from another sector-specific act (DORA, aviation regulations, energy). In practice, essential and important entities silo themselves: they notify their sector regulator (CSSF for DORA for instance) but transmit nothing to the national CSIRT, fearing double sanction or simply unaware of the channel. The outcome: the ILR and GovCERT discover the incident through the press, and the cooperation framework envisaged by NIS 2 collapses into radio silence.

What this recital changes in your governance

Sharing of significant cyber threats (weak signals, IOCs, observed TTPs) is expected upstream of any incident, not only after confirmed compromise.
The sharing channel with the national CSIRT is distinct from the article 23 incident notification channel: it is an additional, declarative step, not sanctionable but strongly encouraged.
For entities under multiple regimes (NIS 2 + DORA, NIS 2 + aviation regulation), you must document a sharing policy that avoids duplication but ensures CSIRT, ILR and sector regulator each receive the useful information.
Absence of voluntary sharing will not be sanctioned directly, but will be read as a low-maturity signal during an ILR inspection on article 21 risk management measures.

How Luxgap automates this risk

Our Luxgap Threat Intel Relay turns your SOC into an active contributor to the NIS 2 ecosystem without overloading your analysts. The tool intercepts IOCs, alerts and weak signals produced by your SIEM (Microsoft Sentinel, Wazuh, Splunk) or EDR (Defender, CrowdStrike), anonymises them according to the TLP grid, and routes them automatically to the relevant CSIRT and sector regulator, using the STIX/TAXII format expected by the Luxembourg GovCERT.

Automatically detects indicators of compromise qualified as significant threats in your SIEM via a scoring grid aligned with ENISA guidelines.
Classifies each signal under TLP:CLEAR / GREEN / AMBER protocols and applies the right level of anonymisation before transmission.
Routes in parallel to the ILR, GovCERT.LU and your sector regulator (CSSF, DAC, ITM) while avoiding duplicate notifications.
Generates a timestamped log of each share, defensible during an ILR inspection as evidence of cooperative maturity within the meaning of recital 26.
Instantly alerts your CISO on Teams or Slack when a threat shared by a peer through the CSIRT matches an IOC present in your own environment.

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real SIEM flows, with a free 48-hour white audit to measure your sharing maturity before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 26

They trust us

Before we chat