I need to bring my Luxembourg organisation into compliance with recital 70 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 70 NIS 2 — Recital 70 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 70

Directive on the security of network and information systems · UE 2022/2555

(70)

Large-scale cybersecurity incidents and crises at Union level require coordinated action to ensure a rapid and effective response because of the high degree of interdependence between sectors and Member States. The availability of cyber-resilient network and information systems and the availability, confidentiality and integrity of data are vital for the security of the Union and for the protection of its citizens, businesses and institutions against incidents and cyber threats, as well as for enhancing the trust of individuals and organisations in the Union’s ability to promote and protect a global, open, free, stable and secure cyberspace grounded in human rights, fundamental freedoms, democracy and the rule of law.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, cyber crisis coordination under recital 70 is operationally driven by the national CSIRT CIRCL (Computer Incident Response Center Luxembourg) and by GOVCERT.LU for the State scope, under ILR supervision for designated essential and important entities. The law of 28 July 2023 on cybersecurity, amended by the law of 28 July 2025, organises information flow between designated operators, the ILR and the HCPN (High Commission for National Protection) for major crises.

Luxgap practice: pre-establish your PGP keys with CIRCL and join the MISP-LU community before any incident, as negotiating channels mid-crisis is a recurring failure point flagged during ILR inspections.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

This recital sets out the principle of a coordinated European response to large-scale cyber crises. In practice, essential and important entities underestimate their role in this chain: they assume a cross-border crisis is ENISA's and the ILR's problem, when in fact their ability to push structured information in under an hour determines the whole EU-CyCLONe coordination. The ILR sanctions less the incident itself than the inability to feed the national CSIRT with usable data during a crisis.

What this recital concretely changes for you

Your incident response plan must include an explicit interface with the national CSIRT (CIRCL in Luxembourg) and a documented, tested exchange channel with the ILR.
Sector interdependencies must be mapped: if you are an energy operator, who depends on you (hospitals, telcos) and who do you depend on (cloud, OT).
Your telemetry data must be shareable in MISP/STIX format to feed European coordination, not just viewable in a proprietary SIEM.
Crisis exercises must include a cross-border spillover scenario, not just an isolated ransomware drill.

How Luxgap automates this risk

Our Luxgap Crisis Mesh Connector turns your isolated crisis cell into an active node of the European EU-CyCLONe network in under 60 seconds after incident declaration. The tool permanently maintains a pre-established encrypted channel with the Luxembourg national CSIRT (CIRCL) and the ILR, and automatically pushes indicators of compromise in MISP/STIX format as soon as an incident is qualified as major, with zero manual formatting.

Automatically detects your critical IT dependencies (cloud providers, OT, telcos, hosting partners) via API scan and network traffic, and computes a real-time cross-border impact score.
Generates MISP-format IoCs as soon as an EDR such as Defender, Sentinel, CrowdStrike or Wazuh raises an incident, and proposes one-click submission to CIRCL with cryptographic timestamping.
Quarterly simulates a coordinated cross-border crisis scenario with an exercise report admissible to the ILR during a NIS 2 inspection.
Alerts in real time on ENISA and CIRCL advisories relevant to your sector, with automatic correlation to your actual exposure.
Produces a timestamped, signed coordination dossier, admissible to the ILR, that demonstrates your operational capacity to contribute to the coordinated European response.

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS brick depending on your scope. Request your demonstration and our teams will prepare a cross-border crisis simulation on your real perimeter, with a free 48-hour blank audit to measure your readiness for EU-CyCLONe coordination before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 70

They trust us

Before we chat