Cybersecurity - NISS

Incident Notification

Incident notification under NIS 2

Under the Act of 5 May 2026 on measures to ensure a high level of cybersecurity (hereinafter “NIS 2 Act”), essential and important entities are required to report significant incidents to the competent authority.
Are you an essential or important entity under NIS 2 operating in one of the sectors supervised by the Institute? You must report incidents to the Institute within the first 24 hours.

Do you need help resolving an incident? You can contact your CSIRT.

If you have any questions, please do not hesitate to contact us directly at incident_notification(at)ilr(.)lu.

Definition of an incident

Incident (Art.2. (5) NIS 2 Act)

‘incident’ means an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems

Significant incident (Art.14. (3) NIS 2 Act)

An incident shall be considered to be significant if:

1° it has caused or is capable of causing severe operational disruption of the services or financial loss for the entity concerned;

2° it has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage.

Etapes de la notification d'incident

01
Preliminary notification
- Without undue delay and no later than 24 hours of becoming aware of the significant incident the preliminary notification has to be send.
- This early warning can also be made when the impact cannot yet be defined, and the incident is potentially not significant.
- The competent authority or the CSIRT provides feedback, where possible, within 24 hours of receiving the early warning.
02
Incident notification
- Within 72 hours of becoming aware of the significant incident , the incident has to be formally notified updating the information provided in the early warning.
- The competent authority or the CSIRT may request interim information to stay informed.
03
Final report
- The final report must be submitted no later than one month after the incident notification
- If the incident has not been closed after one month, an extension of up to one month may be requested for the submission of the final report, and a progress report must be sent one month after the submission of the formal notification instead of the final report.

Content of notifications

The following questions must be answered in the various notifications relating to a significant incident:

Preliminary notification (within 24h)

{"headings":[{"title":"Question","sTitle":"Question"},{"title":"Answer","sTitle":"Answer"}],"body":[["Entity type","<ul>\n<li>Essential</li>\n<li>Important</li>\n</ul>"],["Description of the incident","Free-text field"],["Criteria that make the incident significant","<ul>\n<li>Number of users affected</li>\n<li>Percentage of affected users</li>\n<li>Duration of outage</li>\n<li>Geographical spread</li>\n<li>Direct financial loss</li>\n<li>Non-material damage</li>\n<li>Material damage</li>\n<li>Reputational damage / Incident has received media coverage</li>\n<li>Exfiltration of trade secrets or other sensitive information</li>\n<li>Incident is capable of causing the death of natural person</li>\n<li>Incident is capable of causing considerable damage to natural person’s health</li>\n<li>Incident is capable of gaining a successful, suspectedly malicious and unauthorized access to network and information systems</li>\n<li>None</li>\n<li>Other (specify)</li>\n</ul>"],["Sectors impacted","<ul>\n<li>Energy</li>\n<li>Transport</li>\n<li>Banking</li>\n<li>Financial Market Infrastructures</li>\n<li>Health</li>\n<li>Drinking Water</li>\n<li>Waste Water</li>\n<li>Digital Infrastructures</li>\n<li>Public Administration</li>\n<li>Space</li>\n<li>ICT Service Management (business-to-business)</li>\n<li>Postal and Courrier Services</li>\n<li>Waste Management</li>\n<li>Manufacture, Production and Distribution of Chemicals</li>\n<li>Manufacture, Production and Distribution of Food</li>\n<li>Manufacturing</li>\n<li>Digital Providers</li>\n<li>Research</li>\n<li>Other (specify)</li>\n</ul>"],["Cross-border impact","<ul>\n<li>Yes</li>\n<li>No</li>\n<li>Uncertain</li>\n</ul>"],["In case of a Cross-Border Impact, please indicate the impacted countries","Dropdown list of countries"],["Incident caused by unlawful or malicious acts","<ul>\n<li>Yes</li>\n<li>No</li>\n<li>Uncertain</li>\n</ul>"],["Support required from national CSIRT","<ul>\n<li>Yes</li>\n<li>No</li>\n</ul>"],["In case support is required, please describe the required support in order to effectively respond to the incident","Free-text field"]]}

Incident notification (within 72h)

The questions set out in the preliminary notification will all be included and may be adapted in the incident notification.

The following questions are added to these:

Final report (within 1 month after notifying the incident)

The questions asked in the preliminary notification and the incident notification will all be included and may be adapted in the Final report

The following questions are added to these:

{"headings":[{"title":"Question","sTitle":"Question"},{"title":"Réponse","sTitle":"Réponse"}],"body":[["Indication of the root cause category","<ul>\n<li>Malicious actions</li>\n<li>System failure/malfunction</li>\n<li>Human error</li>\n<li>Third party compromise</li>\n<li>External event</li>\n<li>Unknown</li>\n<li>Other (specify)</li>\n</ul>"],["Indication of the root cause sub-category","<ul>\n<li>Malicious actions: Deliberate internal actions</li>\n<li>Malicious actions: Information gathering</li>\n<li>Malicious actions: Physical damage</li>\n<li>Malicious actions: Malicious code</li>\n<li>Malicious actions: Ransomware</li>\n<li>Malicious actions: Intrusions</li>\n<li>Malicious actions: Intrusion attempts</li>\n<li>Malicious actions: Availability(DoS, DDoS)</li>\n<li>Malicious actions: Fraud</li>\n<li>Malicious actions: Theft/Information content security</li>\n<li>Malicious actions: Unknown</li>\n<li>Malicious actions: Other</li>\n<li>System failure/malfunction: Hardware maintenance</li>\n<li>System failure/malfunction: Hardware capacity and performance</li>\n<li>System failure/malfunction: Hardware obsolescence/ageing</li>\n<li>System failure/malfunction: Software performance</li>\n<li>System failure/malfunction: Software compatibility/configuration</li>\n<li>System failure/malfunction: Network configuration</li>\n<li>System failure/malfunction: Loss of other used infrastructure, e.g. cooling or power distribution</li>\n<li>System failure/malfunction: Physical damage</li>\n<li>System failure/malfunction: Other</li>\n<li>Human error: Mistake or Omission</li>\n<li>Human error: Inadequate resources</li>\n<li>Human error: Skills & knowledge</li>\n<li>Human error: Other</li>\n<li>External event: Force majeure</li>\n<li>External event: Natural disasters</li>\n<li>External event: Other</li>\n</ul>"],["Mitigation measures taken or plan to be taken to prevent the re-occurance of the incident","Free-text field"],["Exploited vulnerability, where applicable","Free-text field"]]}

The legal framework

Find out about the legal framework related to the NISS sector.

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité et portant modification de :
1°la loi modifiée du 14 août 2000 relative au commerce électronique ;
2°la loi modifiée du 23 juillet 2016 portant création d’un Haut-Commissariat à la Protection nationale ;
3°la loi du 17 décembre 2021 sur les réseaux et les services de communications électroniques.

Cadre légal Législation nationale, Lois Cybersécurité - NISS May 6, 2026

More information

Règlement d’exécution (UE) 2024/2690 de la Commission du 17 octobre 2024 établissant des règles relatives à l’application de la directive (UE) 2022/2555 pour ce qui est des exigences techniques et méthodologiques liées aux mesures de gestion des risques en matière de cybersécurité et précisant plus en détail les cas dans lesquels un incident est considéré comme important, en ce qui concerne les fournisseurs de services DNS, les registres des noms de domaine de premier niveau, les fournisseurs de services d’informatique en nuage, les fournisseurs de services de centres de données, les fournisseurs de réseaux de diffusion de contenu, les fournisseurs de services gérés, les fournisseurs de services de sécurité gérés, ainsi que les fournisseurs de places de marché en ligne, de moteurs de recherche en ligne et de plateformes de services de réseaux sociaux, et les prestataires de services de confiance

Cadre légal Textes européens, Règlements UE Cybersécurité - NISS October 18, 2024

More information

DIRECTIVE (UE) 2022/2555 DU PARLEMENT EUROPÉEN ET DU CONSEIL du 14 décembre 2022 concernant des mesures destinées à assurer un niveau élevé commun de cybersécurité dans l’ensemble de l’Union, modifiant le règlement (UE) no 910/2014 et la directive (UE) 2018/1972, et abrogeant la directive (UE) 2016/1148 (directive SRI 2)

Cadre légal Textes européens, Directives Cybersécurité - NISS December 27, 2022

More information

The entire legal framework of the sector

Securing your organisation

The NISS department ensures that legislation on network and information system security is properly enforced across a range of sectors.

More information
NIS 2 Act

Find out more about the NIS 2 Act.

More information
Incident Notification

Please use SERIMA to report incidents.

More information

Rechercher sur le site ILR :

Cybersecurity – NISS

Transport

Our Services & Missions

Rechercher sur le site ILR :

Incident Notification

Incident notification under NIS 2

Definition of an incident

Etapes de la notification d'incident

Preliminary notification

Incident notification

Final report

Content of notifications

Preliminary notification (within 24h)

Incident notification (within 72h)

Final report (within 1 month after notifying the incident)

The legal framework

Institut Luxembourgeois de Régulation

Useful Information

Cybersecurity – NISS

Transport

Our Services & Missions

Incident Notification

Incident notification under NIS 2

Definition of an incident

Etapes de la notification d'incident

Preliminary notification

Incident notification

Final report

Content of notifications

Preliminary notification (within 24h)

Incident notification (within 72h)

Final report (within 1 month after notifying the incident)

The legal framework

Subscribe to our newsletter