Recital 97

Recital 97

Directive on the security of network and information systems · UE 2022/2555

(97)

The internal market is more reliant on the functioning of the internet than ever. The services of almost all essential and important entities are dependent on services provided over the internet. In order to ensure the smooth provision of services provided by essential and important entities, it is important that all providers of public electronic communications networks have appropriate cybersecurity risk-management measures in place and report significant incidents in relation thereto. Member States should ensure that the security of the public electronic communications networks is maintained and that their vital security interests are protected from sabotage and espionage. Since international connectivity enhances and accelerates the competitive digitalisation of the Union and its economy, incidents affecting undersea communications cables should be reported to the CSIRT or, where applicable, the competent authority. The national cybersecurity strategy should, where relevant, take into account the cybersecurity of undersea communications cables and include a mapping of potential cybersecurity risks and mitigation measures to secure the highest level of their protection.

Luxembourg specificity
loi luxembourgeoise du 28 juillet 2023 relative a la cybersecurite, modifiee par la loi du 28 juillet 2025

In Luxembourg, the ILR is the competent authority for both the Electronic Communications Code (law of 17 December 2021) and NIS 2 (law of 28 July 2023 amended by the law of 28 July 2025). Operators of submarine cables landing indirectly in Luxembourg via BE/FR/DE routes must notify GOVCERT.LU (national CSIRT) in parallel with the ILR for any incident affecting international connectivity.

Luxgap practice: we cross-reference your landing mapping with the list of critical operators designated by the ILR to identify whether you have indirect dependency on an essential entity, triggering cascading notification obligations even if you are not a telecom operator yourself.