I need to bring my Luxembourg organisation into compliance with recital 75 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 75 NIS 2 — Recital 75 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 75

Directive on the security of network and information systems · UE 2022/2555

(75)

Peer reviews should be introduced to help learn from shared experiences, strengthen mutual trust and achieve a high common level of cybersecurity. Peer reviews can lead to valuable insights and recommendations strengthening the overall cybersecurity capabilities, creating another functional path for the sharing of best practices across Member States and contributing to enhance the Member States’ levels of maturity in cybersecurity. Furthermore, peer reviews should take account of the results of similar mechanisms, such as the peer-review system of the CSIRTs network, and should add value and avoid duplication. The implementation of peer reviews should be without prejudice to Union or national law on the protection of confidential or classified information.

Luxembourg specificity

loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the ILR is the national competent authority designated by the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) and participates directly in the peer review mechanism provided for in Article 19 NIS 2. The outputs of peer reviews in which the ILR and the national CSIRT (GOVCERT.LU / CIRCL depending on scope) participate directly influence the inspection reference applied to Luxembourgish essential and important operators.

Luxgap practice: for entities supervised by the ILR, we recommend mapping today your posture against the best practices surfaced in published ENISA peer reviews, in order to anticipate ILR inspection questions 12 to 18 months before their formalisation.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Peer reviews between Member States are not an abstract diplomatic exercise: they produce comparative reports that publicly expose maturity gaps among national authorities and, by ricochet, the readiness of the essential and important entities they supervise. The ILR, both observed and observer in this mechanism, will align its inspections with the best practices surfaced by ENISA and the CSIRTs network. Concretely, what is judged 'mature' during a peer review becomes the implicit control standard the following year.

What this recital means for your organisation

Even though peer review targets Member States, its operational fallout hits regulated entities directly:

The ILR's control reference will converge towards best practices identified by ENISA peer reviews (vulnerability management, segmentation, logging, crisis exercises).
Recommendations from peer reviews are published and become implicit expectations during NIS 2 audits.
Entities that align on the NIS Cooperation Group and CSIRTs network outputs gain a defensible lead during inspections.
Shared lessons learned often cover real anonymised incidents: they are ready-to-use exercise scenarios for your internal testing.

How Luxgap automates this risk

Our Luxgap Peer Benchmark Radar turns the public outputs of ENISA peer reviews, the NIS Cooperation Group and the CSIRTs network into a measured gap between your real posture and the emerging European standard, before the ILR even integrates it into its inspection grid. An AI agent continuously ingests ENISA reports, best practices published by national CSIRTs and Cooperation Group recommendations, then automatically confronts them against your technical controls observed via Microsoft Defender, Sentinel, CrowdStrike, Wazuh and your CMDB.

Monitors in real time the publications of ENISA, CSIRT-LU, BSI, ANSSI and NCSC, and extracts the recommendations applicable to your annex I or II sector.
Confronts each recommendation against the reality of your controls via the APIs of your SIEM, EDR and IAM, without asking the CISO to fill in a questionnaire.
Computes a comparative maturity score aligned on the criteria of European peer reviews, per domain (governance, detection, response, continuity, supply chain).
Generates a prioritised roadmap that anticipates by 12 to 18 months the future expectations of the ILR, based on trends observed in previous peer reviews.
Produces a time-stamped PDF report opposable during an ILR inspection, demonstrating proactive alignment on European best practices rather than reactive compliance.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS brick depending on your scope. Request your demonstration and our teams prepare a benchmark on your real scope, with a free white audit within 48h to measure the gap between your posture and the emerging European standard.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 75

They trust us

Before we chat