I need to bring my Luxembourg organisation into compliance with recital 30 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 30 builds a silent bridge between NIS 2 and the CER Directive (EU) 2022/2557 on the resilience of critical entities. In practice, many Luxembourg organisations treat both regimes in silos: cybersecurity on the CIO/CISO side under the ILR, physical security on the facility management side under the High Commission for National Protection (HCPN). The result during an inspection: inconsistent incident notifications between the two authorities, physical measures (datacenter access control, CCTV, guarding) missing from the cyber file, and an inability to demonstrate a coherent approach. If you are identified as a critical entity under CER, you are automatically an essential entity under NIS 2: dual regime, dual supervision, but a single operational reality to document.Concrete friction zones between NIS 2 and CERIncident notifications: a single event (physical intrusion into a datacenter triggering a service outage) must be notified using two distinct templates, with deadlines that may diverge.Dependency mapping: a physical incident (fibre cut, UPS sabotage) has immediate cyber consequences, and the reverse is true (ransomware that disables physical access control).Article 21 NIS 2 measures (physical security of the environment) overlap with CER obligations without replacing them.Audits and inspections potentially conducted by two different authorities over the same perimeter, with a risk of contradictory requests.Shared subcontractors (guarding, HVAC maintenance, remote monitoring) that fall under both regimes simultaneously.How Luxgap automates this riskOur Luxgap Dual-Regime Bridge reconciles your NIS 2 and CER compliance in real time into a single auditable view, and eliminates duplicate work between your cyber and physical security teams. The tool connects simultaneously to your SIEM (Sentinel, Splunk, Wazuh), your physical access control systems (Genetec, Lenel, Nedap), your CMMS (IBM Maximo, SAP PM) and your remote monitoring platforms, then automatically correlates each cyber and physical event to produce a single pre-formatted notification for the ILR and the HCPN.Automatically detects when a group entity shifts from important to essential entity status following a CER designation, and adjusts the scope of applicable controls.Correlates cyber and physical incidents (intrusion + SIEM alert, power outage + service interruption) in under 5 minutes to materialise the causal chain required by both regimes.Generates two synchronised notifications from a single internal form, mapped to the ILR (NIS 2) and HCPN (CER) templates, with cryptographic timestamp of the 24h deadline.Maintains a coherence matrix between article 21 NIS 2 measures and CER resilience plans, flagging shared controls and uncovered zones.Produces a sealed timestamped PDF report, enforceable before both authorities during a joint inspection, demonstrating the coherent approach required by recital 30.Available as a complement to a Luxgap CISO mandate or as...

Recital 30 NIS 2 — Recital 30 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 30

Directive on the security of network and information systems · UE 2022/2555

(30)

In view of the interlinkages between cybersecurity and the physical security of entities, a coherent approach should be ensured between Directive (EU) 2022/2557 of the European Parliament and of the Council (13) and this Directive. To achieve this, entities identified as critical entities under Directive (EU) 2022/2557 should be considered to be essential entities under this Directive. Moreover, each Member State should ensure that its national cybersecurity strategy provides for a policy framework for enhanced coordination within that Member State between its competent authorities under this Directive and those under Directive (EU) 2022/2557 in the context of information sharing about risks, cyber threats, and incidents as well as on non-cyber risks, threats and incidents, and the exercise of supervisory tasks. The competent authorities under this Directive and those under Directive (EU) 2022/2557 should cooperate and exchange information without undue delay, in particular in relation to the identification of critical entities, risks, cyber threats, and incidents as well as in relation to non-cyber risks, threats and incidents affecting critical entities, including the cybersecurity and physical measures taken by critical entities as well as the results of supervisory activities carried out with regard to such entities.

Furthermore, in order to streamline supervisory activities between the competent authorities under this Directive and those under Directive (EU) 2022/2557 and in order to minimise the administrative burden for the entities concerned, those competent authorities should endeavour to harmonise incident notification templates and supervisory processes. Where appropriate, the competent authorities under Directive (EU) 2022/2557, should be able to request the competent authorities under this Directive to exercise their supervisory and enforcement powers in relation to an entity that is identified as a critical entity under Directive (EU) 2022/2557. The competent authorities under this Directive and those under Directive (EU) 2022/2557 should, where possible in real time, cooperate and exchange information for that purpose.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the coordination required by recital 30 involves two distinct authorities: the ILR for NIS 2 (law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025) and the High Commission for National Protection (HCPN) for the CER Directive (transposed by the law on the resilience of critical entities). The law of 28 July 2023 enshrines the assimilation principle: any entity designated as critical by the HCPN is de jure an essential entity under NIS 2, with no additional designation procedure by the ILR.

Luxgap practice: establish a single mapping matrix between your ILR and HCPN obligations, and appoint a common referent who centralises exchanges with both authorities to avoid divergent notifications during a hybrid incident.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 30 builds a silent bridge between NIS 2 and the CER Directive (EU) 2022/2557 on the resilience of critical entities. In practice, many Luxembourg organisations treat both regimes in silos: cybersecurity on the CIO/CISO side under the ILR, physical security on the facility management side under the High Commission for National Protection (HCPN). The result during an inspection: inconsistent incident notifications between the two authorities, physical measures (datacenter access control, CCTV, guarding) missing from the cyber file, and an inability to demonstrate a coherent approach. If you are identified as a critical entity under CER, you are automatically an essential entity under NIS 2: dual regime, dual supervision, but a single operational reality to document.

Concrete friction zones between NIS 2 and CER

Incident notifications: a single event (physical intrusion into a datacenter triggering a service outage) must be notified using two distinct templates, with deadlines that may diverge.
Dependency mapping: a physical incident (fibre cut, UPS sabotage) has immediate cyber consequences, and the reverse is true (ransomware that disables physical access control).
Article 21 NIS 2 measures (physical security of the environment) overlap with CER obligations without replacing them.
Audits and inspections potentially conducted by two different authorities over the same perimeter, with a risk of contradictory requests.
Shared subcontractors (guarding, HVAC maintenance, remote monitoring) that fall under both regimes simultaneously.

How Luxgap automates this risk

Our Luxgap Dual-Regime Bridge reconciles your NIS 2 and CER compliance in real time into a single auditable view, and eliminates duplicate work between your cyber and physical security teams. The tool connects simultaneously to your SIEM (Sentinel, Splunk, Wazuh), your physical access control systems (Genetec, Lenel, Nedap), your CMMS (IBM Maximo, SAP PM) and your remote monitoring platforms, then automatically correlates each cyber and physical event to produce a single pre-formatted notification for the ILR and the HCPN.

Automatically detects when a group entity shifts from important to essential entity status following a CER designation, and adjusts the scope of applicable controls.
Correlates cyber and physical incidents (intrusion + SIEM alert, power outage + service interruption) in under 5 minutes to materialise the causal chain required by both regimes.
Generates two synchronised notifications from a single internal form, mapped to the ILR (NIS 2) and HCPN (CER) templates, with cryptographic timestamp of the 24h deadline.
Maintains a coherence matrix between article 21 NIS 2 measures and CER resilience plans, flagging shared controls and uncovered zones.
Produces a sealed timestamped PDF report, enforceable before both authorities during a joint inspection, demonstrating the coherent approach required by recital 30.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real incidents from the last 12 months, with a free blind audit within 48h to measure your dual-regime exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 30

They trust us

Before we chat