I need to bring my Luxembourg organisation into compliance with recital 80 of NIS 2 (UE 2022/2555). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 80 NIS 2 — Recital 80 · official text + guide

EU frameworkGDPRNIS 2DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 80

Directive on the security of network and information systems · UE 2022/2555

(80)

For the purpose of demonstrating compliance with cybersecurity risk-management measures and in the absence of appropriate European cybersecurity certification schemes adopted in accordance with Regulation (EU) 2019/881 of the European Parliament and of the Council (18), Member States should, in consultation with the Cooperation Group and the European Cybersecurity Certification Group, promote the use of relevant European and international standards by essential and important entities or may require entities to use certified ICT products, ICT services and ICT processes.

Luxembourg specificity

loi du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the ILR is the competent authority designated by the law of 28 July 2023 on cybersecurity (amended by the law of 28 July 2025) to supervise risk-management measures of essential and important entities. ILNAS is the national standardisation and accreditation body: it operates the OLAS accreditation scheme that qualifies the ISO 27001 certifiers recognised by ILR during inspections.

Luxgap practice: have your ISMS certified by an OLAS-accredited body and keep the ENISA Article 21 to ISO 27002:2022 mapping in an admissible form. This combination closes the file during an ILR inspection.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 80 opens the door to an obligation many entities underestimate: during NIS 2 inspections, the ILR may require the use of certified ICT products, services and processes under the Cybersecurity Act. In the absence of mature European schemes, authorities rely on ISO 27001, ISO 27002, IEC 62443, ETSI EN 303 645 and ENISA guides as the de facto standard. The trap: relying on an in-house security policy with no normative reference, then having to rebuild compliance evidence retroactively during an ILR audit.

The de facto standard: what ILR and ENISA expect in practice

ISO/IEC 27001 certified by an OLAS-accredited body remains the reference to demonstrate a structured ISMS covering the 10 measures of NIS 2 Article 21.
ENISA NIS 2 Technical Implementation Guidance published in 2024 maps each Article 21 measure to ISO 27002:2022 controls and CIS Controls v8.
IEC 62443 for OT entities (energy, water, transport, chemical industry under Annex I).
EUCC (first European scheme adopted under the Cybersecurity Act) for critical ICT products: firewalls, HSMs, signature solutions.
SecNumCloud or German C5 de facto recognised for sensitive cloud providers, pending the EUCS scheme.
Documentation of the certification chain of your critical suppliers: an uncertified subcontractor on a critical service becomes your weak point during an inspection.

How Luxgap automates this risk

Our Luxgap Certification Mesh turns the question 'which standards must we apply to prove NIS 2 compliance to ILR' into a living map of your technical stack and suppliers, cross-referenced in real time with relevant European and international certification schemes. The tool continuously queries your cloud provider APIs (Azure, AWS, OVH, LuxConnect, eBRC), your CMDB, your Active Directory and your Odoo contracts to reconstruct the actual certification chain, without any supplier questionnaire to fill out.

Automatically detects each ICT component in production and identifies the applicable certification scheme (EUCC, EUCS, ISO 27001, IEC 62443, SOC 2, HDS, SecNumCloud).
Verifies the validity of supplier certificates by scraping official ENISA, ANSSI, BSI and ILNAS registries, with alerts 90 days before expiry.
Automatically maps each NIS 2 Article 21 measure to the corresponding ISO 27002:2022 and CIS v8 controls, leveraging the ENISA implementation guide.
Computes a normative exposure score per entity and per critical process, highlighting areas where the absence of certification exposes you to an ILR request.
Produces a time-stamped PDF report, admissible during an ILR inspection, demonstrating the normative compliance approach under Article 21(1) NIS 2.
Sends instant alerts (Teams, email) when a new uncertified service is integrated into the ICT supply chain.

Available as a complement to a Luxgap CISO mandate or as a standalone SaaS brick depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual stack, with a free perimeter scan within 48 hours to measure your normative exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 80

They trust us

Before we chat