Recital 68

Recital 68

Directive on the security of network and information systems · UE 2022/2555

(68)

Member States should contribute to the establishment of the EU Cybersecurity Crisis Response Framework as set out in Commission Recommendation (EU) 2017/1584 (15) through the existing cooperation networks, in particular the European cyber crisis liaison organisation network (EU-CyCLONe), the CSIRTs network and the Cooperation Group. EU-CyCLONe and the CSIRTs network should cooperate on the basis of procedural arrangements that specify the details of that cooperation and avoid any duplication of tasks. EU-CyCLONe’s rules of procedure should further specify the arrangements through which that network should function, including the network’s roles, means of cooperation, interactions with other relevant actors and templates for information sharing, as well as means of communication. For crisis management at Union level, relevant parties should rely on the EU Integrated Political Crisis Response arrangements under Council Implementing Decision (EU) 2018/1993 (16) (IPCR arrangements). The Commission should use the ARGUS high-level cross-sectoral crisis coordination process for that purpose. If the crisis entails an important external or Common Security and Defence Policy dimension, the European External Action Service Crisis Response Mechanism should be activated.

Luxembourg specificity
loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the ILR is the NIS 2 competent authority and receives incident notifications, while GOVCERT.LU (public sector and essential operators) and CIRCL (private non-governmental sector) act as the national CSIRT and participate in the CSIRTs network and EU-CyCLONe. The Law of 28 July 2023 on cybersecurity, amended by the Law of 28 July 2025, organises this articulation and requires cooperation with the HCPN (High Commission for National Protection) for crises with a political dimension.

Luxgap practice: your playbook must explicitly name the correct CSIRT based on your status (GOVCERT.LU or CIRCL), with up-to-date 24/7 contacts and an out-of-band fallback channel (landline + PGP email) tested every quarter.