I need to bring my Luxembourg organisation into compliance with recital 40 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 40 organises the cross-border circulation of incident notifications through the single points of contact (SPOC). In practice, essential and important entities notify the national CSIRT (in Luxembourg, GOVCERT for the public sector and CIRCL for the private sector), but forget that if the incident affects subsidiaries, clients or suppliers in other Member States, the Luxembourg SPOC must be able to forward the information to foreign SPOCs. The ILR sanctions entities that notify in a fragmented way, without mapping the cross-border dimension of the incident, making the European coordination expected by the directive impossible.What recital 40 concretely imposes on your incident frameworkYour notification playbook must identify from the first hour whether the incident has cross-border impact: EU subsidiaries affected, EU clients impacted, EU suppliers compromised, EU services unavailable.The notification to the national CSIRT must contain an explicit section on the Member States concerned, to allow the SPOC to trigger the forwarding required by recital 40.If you are a financial entity subject to DORA (EU 2022/2554), your CSSF notification can be relayed to the NIS 2 SPOC: your internal procedure must provide for this bidirectional bridge to avoid inconsistent double notification.The national cross-sectoral coordination (health, energy, finance, telecom) also goes through the SPOC: an incident at your cloud provider may concern several regulated sectors simultaneously.Keep the timestamped evidence of each exchange with the CSIRT and the SPOC, enforceable in case of ILR inspection.How Luxgap automates this riskOur Luxgap Cross-Border Incident Router turns your crisis cell into a multi-jurisdictional notification engine that automatically qualifies the cross-border scope of an incident in under 15 minutes. The tool ingests alerts from your SIEM (Microsoft Sentinel, Splunk, Wazuh, CrowdStrike Falcon) and correlates in real time the affected assets with your EU footprint map, your GDPR client contracts and your inter-subsidiary data flows, to produce the list of foreign SPOCs to alert via the Luxembourg SPOC.Automatically detects the cross-border dimension of an incident by correlating compromised IPs, hostnames and tenants with your registry of EU locations and EU clients.Generates pre-filled notifications for the ILR, the national CSIRT (GOVCERT or CIRCL) and the CSSF in parallel, with automatic mapping of DORA fields onto NIS 2.Identifies in real time the affected Member States to declare to the SPOC, relying on the location of data, users and critical services impacted.Alerts executives via Teams or Signal as soon as the significant incident threshold under article 23 NIS 2 is likely to be crossed, with a countdown on the 24h / 72h / 1 month deadlines.Produces a cryptographically sealed incident log, timestamped, enforceable against the ILR during an inspection to demonstrate compliance with deadlines and cross-border coord...

Recital 40 NIS 2 — Recital 40 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 40

Directive on the security of network and information systems · UE 2022/2555

(40)

The single points of contact should ensure effective cross-border cooperation with relevant authorities of other Member States and, where appropriate, with the Commission and ENISA. The single points of contact should therefore be tasked with forwarding notifications of significant incidents with cross-border impact to the single points of contact of other affected Member States upon the request of the CSIRT or the competent authority. At national level, the single points of contact should enable smooth cross-sectoral cooperation with other competent authorities. The single points of contact could also be the addressees of relevant information about incidents concerning financial entities from the competent authorities under Regulation (EU) 2022/2554 which they should be able to forward, as appropriate, to the CSIRTs or the competent authorities under this Directive.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, designates the ILR as competent authority and national single point of contact within the meaning of recital 40. The operational CSIRTs are GOVCERT.LU for public entities and CIRCL (Computer Incident Response Center Luxembourg, operated by SECURITYMADEIN.LU) for private entities. Financial entities subject to DORA notify in parallel to the CSSF, which can relay the information to the ILR SPOC for cross-border forwarding.

Luxgap practice: map upstream your three notification channels (competent CSIRT, ILR as SPOC, CSSF if applicable) and formalise in writing who triggers what in the first 24 hours, to avoid missing notification or inconsistent double notification.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 40 organises the cross-border circulation of incident notifications through the single points of contact (SPOC). In practice, essential and important entities notify the national CSIRT (in Luxembourg, GOVCERT for the public sector and CIRCL for the private sector), but forget that if the incident affects subsidiaries, clients or suppliers in other Member States, the Luxembourg SPOC must be able to forward the information to foreign SPOCs. The ILR sanctions entities that notify in a fragmented way, without mapping the cross-border dimension of the incident, making the European coordination expected by the directive impossible.

What recital 40 concretely imposes on your incident framework

Your notification playbook must identify from the first hour whether the incident has cross-border impact: EU subsidiaries affected, EU clients impacted, EU suppliers compromised, EU services unavailable.
The notification to the national CSIRT must contain an explicit section on the Member States concerned, to allow the SPOC to trigger the forwarding required by recital 40.
If you are a financial entity subject to DORA (EU 2022/2554), your CSSF notification can be relayed to the NIS 2 SPOC: your internal procedure must provide for this bidirectional bridge to avoid inconsistent double notification.
The national cross-sectoral coordination (health, energy, finance, telecom) also goes through the SPOC: an incident at your cloud provider may concern several regulated sectors simultaneously.
Keep the timestamped evidence of each exchange with the CSIRT and the SPOC, enforceable in case of ILR inspection.

How Luxgap automates this risk

Our Luxgap Cross-Border Incident Router turns your crisis cell into a multi-jurisdictional notification engine that automatically qualifies the cross-border scope of an incident in under 15 minutes. The tool ingests alerts from your SIEM (Microsoft Sentinel, Splunk, Wazuh, CrowdStrike Falcon) and correlates in real time the affected assets with your EU footprint map, your GDPR client contracts and your inter-subsidiary data flows, to produce the list of foreign SPOCs to alert via the Luxembourg SPOC.

Automatically detects the cross-border dimension of an incident by correlating compromised IPs, hostnames and tenants with your registry of EU locations and EU clients.
Generates pre-filled notifications for the ILR, the national CSIRT (GOVCERT or CIRCL) and the CSSF in parallel, with automatic mapping of DORA fields onto NIS 2.
Identifies in real time the affected Member States to declare to the SPOC, relying on the location of data, users and critical services impacted.
Alerts executives via Teams or Signal as soon as the significant incident threshold under article 23 NIS 2 is likely to be crossed, with a countdown on the 24h / 72h / 1 month deadlines.
Produces a cryptographically sealed incident log, timestamped, enforceable against the ILR during an inspection to demonstrate compliance with deadlines and cross-border coordination.

Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams prepare a demonstration on your real EU footprint map, with a free 48h white audit to measure your cross-border exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 40

They trust us

Before we chat