I need to bring my Luxembourg organisation into compliance with recital 42 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 42 NIS 2 — Recital 42 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 42

Directive on the security of network and information systems · UE 2022/2555

(42)

The CSIRTs are tasked with incident handling. This includes the processing of large volumes of sometimes sensitive data. Member States should ensure that the CSIRTs have an infrastructure for information sharing and processing, as well as well-equipped staff, which ensures the confidentiality and trustworthiness of their operations. The CSIRTs could also adopt codes of conduct in that respect.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite (modifiee par la loi du 28 juillet 2025)

In Luxembourg, the national CSIRT designated by the law of 28 July 2023 on cybersecurity is GOVCERT.LU for public entities and CIRCL for private entities, under ILR coordination. Essential and important entities must transmit notifications through official channels published by the ILR, not standard email. The law of 28 July 2025 clarified the confidentiality requirements imposed on entities during information exchange with the CSIRT.

Luxgap practice: pre-configure your SOC connectors to the correct CSIRT (GOVCERT.LU or CIRCL depending on your status) using their published PGP keys, and test the channel quarterly through a documented tabletop exercise.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital targets CSIRTs themselves, but it has a direct impact on essential and important entities that transmit incident notifications to them. The ILR and GOVCERT.LU will in practice expect uploaded flows to be already structured, classified and traceable. Organisations that transmit raw dumps, unfiltered logs or non-minimised personal data face a double risk: NIS 2 article 23 non-compliance and a GDPR article 32 breach during the transfer to the authority itself.

What recital 42 cascades onto notifying entities

Maintain an encrypted transmission channel to the national CSIRT, distinct from standard email, with timestamped acknowledgement of receipt.
Pre-classify each transmitted artefact (TLP:RED, TLP:AMBER+STRICT, TLP:GREEN) following the FIRST standard adopted by ENISA.
Minimise personal data before transmission: pseudonymise employee identifiers, mask customer data outside the investigation scope.
Keep a cryptographically sealed mirror copy of what was transmitted, to prove accuracy if challenged later.
Adopt an internal code of conduct aligned with the receiving CSIRT, to avoid operational friction during the critical incident-handling phase.

How Luxgap automates this risk

Our Luxgap CSIRT Liaison Channel eliminates the risk of transmitting misclassified, non-minimised or untraceable data to the ILR and GOVCERT.LU during an incident. The tool intercepts artefacts collected by your SOC (Microsoft Defender, Sentinel, CrowdStrike, Wazuh), classifies them automatically under the ENISA TLP protocol, applies a layer of personal data pseudonymisation, and transmits them through an encrypted channel with a timestamped proof of delivery.

Detects GDPR personal data inside logs and memory dumps before transmission, and applies reversible pseudonymisation kept internal only.
Classifies each artefact under the FIRST/ENISA TLP protocol and automatically blocks any TLP:RED transmission through a non-encrypted channel.
Generates a timestamped, cryptographically sealed transmission slip listing each element sent to the CSIRT with its SHA-256 hash.
Maintains a local encrypted mirror copy of transmitted artefacts for the statutory retention period of incident evidence.
Alerts in real time via Teams or Slack when an analyst tries to transmit data beyond a valid investigation perimeter.
Produces the compliance report covering NIS 2 article 23 and GDPR article 32, demonstrating that the transmission meets confidentiality requirements of both regimes.

Available as part of a Luxgap CISO or DPO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual SOC stack, with a free 48-hour blank audit to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 42

They trust us

Before we chat