I need to bring my Luxembourg organisation into compliance with recital 43 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 43 opens a little-known door: an essential or important entity can request the CSIRT (in Luxembourg, GOVCERT or a sectoral CSIRT coordinated by ILR) to perform a proactive scan of its networks. In practice, organisations that request this scan without having prepared their asset inventory and their GDPR legal basis for processing logs end up either cancelling the scan at the last minute or exposing personal data without proper framing. ILR already sanctions the opposite case: entities that have no documented operational relationship with a CSIRT when they could have benefited from one.Turning this recital into an operational advantageThe CSIRT scan is declarative and voluntary, but it becomes article 21 NIS 2 accountability evidence if you trace it correctly.A prior GDPR agreement between the entity and the CSIRT is required: purpose, retention of scan results, legal basis (legitimate interest or legal obligation depending on the case).The mapping of exposed assets (public IPs, subdomains, certificates, SaaS services) must be up to date before triggering the scan, otherwise the CSIRT report flags blind spots you did not even know existed.Scan results must be integrated into your remediation plan with closure dates, otherwise ILR considers you were aware of the risk without acting.If you are a subsidiary of a foreign group, check which sectoral CSIRT has jurisdiction (finance, energy, health, digital infrastructure) because response times vary.How Luxgap automates this riskOur Luxgap CSIRT Liaison Hub turns the relationship with GOVCERT and Luxembourg sectoral CSIRTs into a permanent operational channel, rather than a panic call during an incident. The tool continuously maintains your external attack surface (DNS, certificates, exposed ports, HIBP leaks, dark web mentions) and automatically prepares the technical dossier to hand over to the CSIRT the day you trigger a proactive scan under recital 43.Continuously scans your external perimeter via Shodan, Censys, crt.sh and HaveIBeenPwned integrations and compares results with your declared CMDB (Azure, AWS, GCP, Cloudflare, OVH).Generates a CSIRT request dossier ready to send, including asset mapping, GDPR legal basis for the scan, list of authorised recipients and confidentiality matrix.Detects gaps between declared assets and actually exposed assets, and alerts instantly via Teams or Slack whenever a new subdomain or SaaS service appears without being registered.Integrates received CSIRT reports into a timestamped remediation plan, with automatic assignment to IT teams and SLA tracking by CVSS criticality.Produces a cryptographically sealed PDF report, enforceable before ILR in case of audit, proving you requested and integrated CSIRT assistance in line with the spirit of recital 43.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real per...

Recital 43 NIS 2 — Recital 43 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 43

Directive on the security of network and information systems · UE 2022/2555

(43)

As regards personal data, the CSIRTs should be able to provide, in accordance with Regulation (EU) 2016/679, upon the request of an essential or important entity, a proactive scanning of the network and information systems used for the provision of the entity’s services. Where applicable, Member States should aim to ensure an equal level of technical capabilities for all sectoral CSIRTs. Member States should be able to request the assistance of ENISA in developing their CSIRTs.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the proactive scan referred to in recital 43 is mainly operated by GOVCERT.LU for the public sector and operators of vital importance, and by sectoral CSIRTs coordinated by ILR under the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025). ILR designates essential and important entities and formalises the procedure for engaging the competent CSIRT.

Luxgap practice: we prepare the scan agreement with GOVCERT.LU or the competent sectoral CSIRT, including the GDPR legal basis and confidentiality matrix, before any activation.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 43 opens a little-known door: an essential or important entity can request the CSIRT (in Luxembourg, GOVCERT or a sectoral CSIRT coordinated by ILR) to perform a proactive scan of its networks. In practice, organisations that request this scan without having prepared their asset inventory and their GDPR legal basis for processing logs end up either cancelling the scan at the last minute or exposing personal data without proper framing. ILR already sanctions the opposite case: entities that have no documented operational relationship with a CSIRT when they could have benefited from one.

Turning this recital into an operational advantage

The CSIRT scan is declarative and voluntary, but it becomes article 21 NIS 2 accountability evidence if you trace it correctly.
A prior GDPR agreement between the entity and the CSIRT is required: purpose, retention of scan results, legal basis (legitimate interest or legal obligation depending on the case).
The mapping of exposed assets (public IPs, subdomains, certificates, SaaS services) must be up to date before triggering the scan, otherwise the CSIRT report flags blind spots you did not even know existed.
Scan results must be integrated into your remediation plan with closure dates, otherwise ILR considers you were aware of the risk without acting.
If you are a subsidiary of a foreign group, check which sectoral CSIRT has jurisdiction (finance, energy, health, digital infrastructure) because response times vary.

How Luxgap automates this risk

Our Luxgap CSIRT Liaison Hub turns the relationship with GOVCERT and Luxembourg sectoral CSIRTs into a permanent operational channel, rather than a panic call during an incident. The tool continuously maintains your external attack surface (DNS, certificates, exposed ports, HIBP leaks, dark web mentions) and automatically prepares the technical dossier to hand over to the CSIRT the day you trigger a proactive scan under recital 43.

Continuously scans your external perimeter via Shodan, Censys, crt.sh and HaveIBeenPwned integrations and compares results with your declared CMDB (Azure, AWS, GCP, Cloudflare, OVH).
Generates a CSIRT request dossier ready to send, including asset mapping, GDPR legal basis for the scan, list of authorised recipients and confidentiality matrix.
Detects gaps between declared assets and actually exposed assets, and alerts instantly via Teams or Slack whenever a new subdomain or SaaS service appears without being registered.
Integrates received CSIRT reports into a timestamped remediation plan, with automatic assignment to IT teams and SLA tracking by CVSS criticality.
Produces a cryptographically sealed PDF report, enforceable before ILR in case of audit, proving you requested and integrated CSIRT assistance in line with the spirit of recital 43.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free external attack surface scan within 48 hours to materialise your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 43

They trust us

Before we chat