Recital 53
Directive on the security of network and information systems · UE 2022/2555
| (53) | Utilities are increasingly connected to digital networks in cities, for the purpose of improving urban transport networks, upgrading water supply and waste disposal facilities and increasing the efficiency of lighting and the heating of buildings. Those digitalised utilities are vulnerable to cyberattacks and run the risk, in the event of a successful cyberattack, of harming citizens at a large scale due to their interconnectedness. Member States should develop a policy that addresses the development of such connected or smart cities, and their potential effects on society, as part of their national cybersecurity strategy. |
In Luxembourg, the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) designates the ILR as the competent authority to qualify municipalities, intermunicipal syndicates (SIDOR, SIDEC, SIVEC) and urban utilities as essential or important entities under Annexes I and II. The Luxembourg national cybersecurity strategy explicitly covers the smart city dimension, alongside LuxConnect, POST and smart territory initiatives led by the Ministry of the Interior.
Luxgap practice: we map your municipality's or syndicate's actual NIS 2 perimeter by cross-referencing your IP ranges, smart city integration contracts and ILR doctrine, to avoid surprise reclassification during a first inspection.
