I need to bring my Luxembourg organisation into compliance with recital 48 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 48 NIS 2 — Recital 48 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 48

Directive on the security of network and information systems · UE 2022/2555

(48)

For the purpose of achieving and maintaining a high level of cybersecurity, the national cybersecurity strategies required under this Directive should consist of coherent frameworks providing strategic objectives and priorities in the area of cybersecurity and the governance to achieve them. Those strategies can be composed of one or more legislative or non-legislative instruments.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) transposes NIS 2 and confirms the National Cybersecurity Strategy led by HCPN as the reference framework. The ILR designates essential and important operators and expects their internal policies to be explicitly linked to national strategic objectives, failing which non-compliance is flagged during inspections.

Luxgap practice: we reconcile your ISMS policy with the LU national strategy and ILR / GOVCERT.lu guidance, and we produce an alignment matrix opposable during an audit.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 48 sheds light on Article 7 on national cybersecurity strategies. In practice, many essential and important entities ignore the content of the Luxembourg strategy and miss the sectoral priorities that the ILR uses to calibrate its inspections. The trap: aligning internal policy on a generic standard (ISO 27001) without reconciling it with the Luxembourg national cybersecurity strategy and ENISA guidance, producing a documentary gap that the ILR immediately flags during an audit.

Why this recital changes your implementation

This recital imposes a coherent framework on Member States, but it has a domino effect on regulated entities: your security policy must explicitly map to national strategic objectives. Concretely:

Your ISMS policy must cite the Luxembourg national strategy and explain how your technical and organisational measures contribute to it.
Your crisis management plans must be consistent with the national cyber emergency response plan coordinated by HCPN and GOVCERT.lu.
Your continuity exercises must integrate the sectoral priority scenarios identified by the ILR (energy, health, finance, digital infrastructure).
Your risk mapping must reflect the threats identified in the annual ENISA threat landscapes.

How Luxgap automates this risk

Our Luxgap Strategy Alignment Engine turns the Luxembourg national strategy and ENISA guidance into a living control grid that continuously measures the alignment of your ISMS policy with ILR priorities. The tool automatically ingests official publications (LU National Cybersecurity Strategy, ILR guides, ENISA threat landscape, GOVCERT.lu recommendations) and cross-references their content with your internal policies via an LLM agent specialised in cyber-governance.

Automatically detects each new official publication (ILR, HCPN, ENISA, GOVCERT.lu) and alerts the relevant CISOs within 24h.
Classifies each national strategic objective and maps it to your internal controls under ISO 27001, NIST CSF or CIS Controls.
Generates a strategic alignment report that demonstrates, clause by clause, how your ISMS policy responds to national priorities.
Produces a coverage matrix opposable to the ILR during an inspection, time-stamped and cryptographically sealed.
Alerts in real time on gaps between your policy and the new version of the national strategy as soon as it is published.
Proposes pre-drafted policy update templates tailored to your sector (annex I or II).

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real ISMS policy, with a free 48h white audit to measure your alignment gap before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 48

They trust us

Before we chat