Directive (EU) 2022/2555 · Cybersecurity
NIS 2 compliance in Luxembourg.
The NIS 2 directive was transposed into Luxembourg law on 1 July 2024. It requires more than 1,200 Luxembourg companies identified by the ILR to put in place cyber governance, 24h incident reporting and supply chain risk management. Fines of up to €10M or 2% of worldwide turnover.
Who is subject to NIS 2 in Luxembourg?
Two categories: essential entities (250+ staff or turnover of €50M+) in 11 sectors (energy, transport, banking, financial markets, health, water, digital infrastructure, public administration, space, ICT service providers, critical B2B) and important entities (50+ employees or turnover of €10M+) in 7 additional sectors (postal services, waste management, manufacturing, research, food, chemicals, digital providers).
In Luxembourg, the ILR has identified more than 1,200 companies in scope. Each one is notified individually by official letter.
In Luxembourg, the ILR has identified more than 1,200 companies in scope. Each one is notified individually by official letter.
What does NIS 2 require day to day?
Cyber governance at board level (personal liability of management). Cyber risk management policy with regular analysis. Minimum technical measures (encryption, MFA, segmentation, backup, access management). Business continuity plan and post-incident recovery plan. Supply chain security: audit of critical suppliers. Mandatory cybersecurity training for management and IT teams. Incident reporting to the ILR within 24h (early warning), 72h (intermediate report), 1 month (final report).
Why an outsourced CISO for NIS 2?
Our outsourced CISO mandate covers all NIS 2 requirements: ISO 27001 security policy, ICT risk management, governance, 24h incident reporting, supply chain audit, staff awareness.
Hiring a senior in-house CISO in Luxembourg is expensive and slow. Our outsourced mandate gives you a team of cyber engineers for a fraction of the cost, with a regular on-site presence. You are compliant, and you keep your cash.
Build a CISO mandate →
Hiring a senior in-house CISO in Luxembourg is expensive and slow. Our outsourced mandate gives you a team of cyber engineers for a fraction of the cost, with a regular on-site presence. You are compliant, and you keep your cash.
Build a CISO mandate →
What are the NIS 2 sanctions in Luxembourg?
The transposition bill provides for fines of up to €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important entities (whichever is higher). On top of that: a temporary ban on exercising management functions in the event of a serious breach, publication of the sanction (reputational damage), and civil liability in the event of an incident.
Let's talk about your situation.
Quote within 24 business hours. No commitment, no sales pressure.