NIS 2 compliance in Luxembourg.

Two categories, by sector and size (Articles 1 and 11 of the law of 5 May 2026). Essential entities are first of all large enterprises (250 staff or more, or turnover above €50M and balance sheet above €43M) in the 11 highly critical sectors (energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, business-to-business ICT service management, public administration, space); they also include, among others and whatever their size, public administration entities, qualified trust service providers, top-level domain name registries and DNS service providers. Important entities are, as a rule, the other entities in scope, from medium size upwards (50 staff or more, or turnover and balance sheet both above €10M): in particular medium-sized enterprises in those 11 sectors, and medium-sized and large enterprises in the 7 other critical sectors (postal and courier services, waste management, chemicals, food, manufacturing, digital providers, research).

In Luxembourg, entities in scope had to register themselves with the ILR (or with the CSSF for banking and financial market infrastructures) by 10 July 2026; the authority then confirms their designation as an essential or important entity.

Cyber governance at board level (personal liability of management). Cyber risk management policy with regular analysis. Minimum technical measures (encryption, MFA, segmentation, backup, access management). Business continuity plan and post-incident recovery plan. Supply chain security: audit of critical suppliers. Mandatory cybersecurity training for management and IT teams. Notification of significant incidents to the ILR (the CSSF for the digital infrastructure and ICT services it supervises): early warning within 24h, incident notification within 72h, final report no later than one month after it; an intermediate report may be requested in between. Banks and financial market infrastructures notify under DORA.

Our outsourced CISO mandate covers all NIS 2 requirements: ISO 27001 security policy, ICT risk management, governance, 24h incident reporting, supply chain audit, staff awareness.

Hiring a senior in-house CISO in Luxembourg is expensive and slow. Our outsourced mandate gives you a team of cyber engineers for a fraction of the cost, with a regular on-site presence. You are compliant, and you keep your cash.

Build a CISO mandate →

The law of 5 May 2026 provides for fines of up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities (whichever is higher). On top of that: for an essential entity that does not remedy a breach within the set deadline, a temporary ban on a manager exercising management functions, ordered by the court at the authority's request; an order to make public aspects of the breach (reputational damage); and ordinary civil liability in the event of an incident.