I need to bring my Luxembourg organisation into compliance with recital 28 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapThis recital sets the lex specialis rule: DORA prevails over NIS 2 for financial entities. The trap hits hybrid groups (industrial holding with a PFS subsidiary, fintech with non-financial activities, captive insurer of an industrial group) that apply a single framework across the whole perimeter. The CSSF and the ILR then point at each other, and the entity ends up under double supervision. Entity-by-entity qualification is the first compliance step, not a legal detail.The DORA vs NIS 2 routing testBefore any technical measure, each entity of the group must be qualified against a precise grid. The criteria to document:Regulatory status of the entity (credit institution, PFS, investment firm, insurer, fund manager, crypto-asset service provider under MiCA): if yes, DORA applies for ICT risk management.Actual activity beyond the status: an unregulated holding hosting the IT of a banking subsidiary can fall under DORA via the critical ICT third-party provider notion.Sub-contractors shared between DORA entities and NIS 2 entities: the same cloud provider must be contracted differently depending on the client entity.Incident notifications: CSSF via the DORA channel for financial entities, ILR via the NIS 2 platform for the others, with different deadlines and thresholds.Resilience testing: DORA TLPT every 3 years for significant entities, NIS 2 article 21 technical measures for the others.National cybersecurity strategy: the financial sector remains included even if it is not subject to NIS 2 obligations, so the ILR keeps an information channel.How Luxgap automates this riskOur Luxgap Regulatory Scope Mapper removes the DORA vs NIS 2 grey zone by automatically qualifying each legal entity of your group and each shared sub-contractor. The tool cross-references your Luxembourg RCS registry, your CSSF/CAA authorizations, your Active Directory and your supplier contracts in Odoo or SAP Ariba to produce an opposable regulatory map, without asking the CISO to fill in a 200-line spreadsheet.Classifies each entity of the group (DORA, NIS 2 essential, NIS 2 important, out of scope) against the consolidated criteria of EU Regulation 2022/2554 and the Luxembourg law of 28 July 2023.Detects ICT sub-contractors shared between financial and non-financial entities and flags the contractual clauses to duplicate.Generates pre-configured notification channels: CSSF flow for DORA, ILR platform for NIS 2, with the deadlines and thresholds proper to each regime.Alerts in real time when a change of authorization, an acquisition or a new service exposes an entity to a regime shift.Produces a cryptographically sealed timestamped PDF report, opposable during a CSSF or ILR inspection, evidencing the regulatory qualification of each entity at a given date.Available as a complement to a Luxgap CISO or DPO mandate or as a standalone SaaS module depending on your perimeter. Request a tailored quote and our teams prepare a demonstration on your actual group stru...

Recital 28 NIS 2 — Recital 28 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 28

Directive on the security of network and information systems · UE 2022/2555

(28)

Regulation (EU) 2022/2554 of the European Parliament and of the Council (10) should be considered to be a sector-specific Union legal act in relation to this Directive with regard to financial entities. The provisions of Regulation (EU) 2022/2554 relating to information and communication technology (ICT) risk management, management of ICT-related incidents and, in particular, major ICT-related incident reporting, as well as on digital operational resilience testing, information-sharing arrangements and ICT third-party risk should apply instead of those provided for in this Directive. Member States should therefore not apply the provisions of this Directive on cybersecurity risk-management and reporting obligations, and supervision and enforcement, to financial entities covered by Regulation (EU) 2022/2554. At the same time, it is important to maintain a strong relationship and the exchange of information with the financial sector under this Directive. To that end, Regulation (EU) 2022/2554 allows the European Supervisory Authorities (ESAs) and the competent authorities under that Regulation to participate in the activities of the Cooperation Group and to exchange information and cooperate with the single points of contact, as well as with the CSIRTs and the competent authorities under this Directive. The competent authorities under Regulation (EU) 2022/2554 should also transmit details of major ICT-related incidents and, where relevant, significant cyber threats to the CSIRTs, the competent authorities or the single points of contact under this Directive. This is achievable by providing immediate access to incident notifications and forwarding them either directly or through a single entry point. Moreover, Member States should continue to include the financial sector in their cybersecurity strategies and CSIRTs can cover the financial sector in their activities.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the DORA vs NIS 2 routing is particularly sensitive given the density of the financial sector: support PFS (articles 29-1 to 29-6 of the law of 5 April 1993), fund depositaries and alternative managers fall under DORA and therefore escape the cyber obligations of the law of 28 July 2023 on cybersecurity, but their unregulated subsidiaries (holdings, ServCos, real estate vehicles) may remain under NIS 2 supervised by the ILR. The CSSF remains the competent authority for major ICT incident notification on the DORA side, while the ILR centralizes NIS 2 notifications.

Luxgap practice: we recommend an entity-by-entity mapping formalized in a regime matrix jointly validated by the CISO and the compliance officer, and reviewed at each change of CSSF authorization or group structure.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital sets the lex specialis rule: DORA prevails over NIS 2 for financial entities. The trap hits hybrid groups (industrial holding with a PFS subsidiary, fintech with non-financial activities, captive insurer of an industrial group) that apply a single framework across the whole perimeter. The CSSF and the ILR then point at each other, and the entity ends up under double supervision. Entity-by-entity qualification is the first compliance step, not a legal detail.

The DORA vs NIS 2 routing test

Before any technical measure, each entity of the group must be qualified against a precise grid. The criteria to document:

Regulatory status of the entity (credit institution, PFS, investment firm, insurer, fund manager, crypto-asset service provider under MiCA): if yes, DORA applies for ICT risk management.
Actual activity beyond the status: an unregulated holding hosting the IT of a banking subsidiary can fall under DORA via the critical ICT third-party provider notion.
Sub-contractors shared between DORA entities and NIS 2 entities: the same cloud provider must be contracted differently depending on the client entity.
Incident notifications: CSSF via the DORA channel for financial entities, ILR via the NIS 2 platform for the others, with different deadlines and thresholds.
Resilience testing: DORA TLPT every 3 years for significant entities, NIS 2 article 21 technical measures for the others.
National cybersecurity strategy: the financial sector remains included even if it is not subject to NIS 2 obligations, so the ILR keeps an information channel.

How Luxgap automates this risk

Our Luxgap Regulatory Scope Mapper removes the DORA vs NIS 2 grey zone by automatically qualifying each legal entity of your group and each shared sub-contractor. The tool cross-references your Luxembourg RCS registry, your CSSF/CAA authorizations, your Active Directory and your supplier contracts in Odoo or SAP Ariba to produce an opposable regulatory map, without asking the CISO to fill in a 200-line spreadsheet.

Classifies each entity of the group (DORA, NIS 2 essential, NIS 2 important, out of scope) against the consolidated criteria of EU Regulation 2022/2554 and the Luxembourg law of 28 July 2023.
Detects ICT sub-contractors shared between financial and non-financial entities and flags the contractual clauses to duplicate.
Generates pre-configured notification channels: CSSF flow for DORA, ILR platform for NIS 2, with the deadlines and thresholds proper to each regime.
Alerts in real time when a change of authorization, an acquisition or a new service exposes an entity to a regime shift.
Produces a cryptographically sealed timestamped PDF report, opposable during a CSSF or ILR inspection, evidencing the regulatory qualification of each entity at a given date.

Available as a complement to a Luxgap CISO or DPO mandate or as a standalone SaaS module depending on your perimeter. Request a tailored quote and our teams prepare a demonstration on your actual group structure, with a free 48h scoping audit to measure your dual-regime exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 28

They trust us

Before we chat