{"id":38985,"date":"2026-09-28T10:00:24","date_gmt":"2026-09-28T08:00:24","guid":{"rendered":"https:\/\/www.ilr.lu\/?post_type=actualite&p=38985"},"modified":"2026-09-25T15:37:23","modified_gmt":"2026-09-25T13:37:23","slug":"operational-guidance-for-incident-handling","status":"publish","type":"actualite","link":"https:\/\/www.ilr.lu\/en\/actualite\/operational-guidance-for-incident-handling\/","title":{"rendered":"Operational guidance for incident handling"},"content":{"rendered":"

The High Commission for National Protection<\/em> (\u201cHCPN\u201d), acting in its role as the Agence Nationale de la S\u00e9curit\u00e9 des Syst\u00e8mes d\u2019Information<\/em> (\u201cANSSI\u201d) and as the Governmental Computer Security Incident Response Team<\/em> (\u201cGOVCERT.LU\u201d), the Computer Incident Response Center Luxembourg<\/em> (\u201cCIRCL\u201d), the Commission de Surveillance du Secteur Financier<\/em> (\u201cCSSF\u201d), and the Institut Luxembourgeois de R\u00e9gulation<\/em> (\u201cILR\u201d) are pleased to announce that a team of cyber security experts of the mentioned institutions jointly wrote a set of rulebooks\u00a0related to operational guidance for incident handling<\/a>.<\/p>\n

 <\/p>\n

Why were these rulebooks developed?<\/strong><\/p>\n

The rulebooks were developed in the context of Article 14(5) of the Loi du 5 mai 2026 concernant des mesures destin\u00e9es \u00e0 assurer un niveau \u00e9lev\u00e9 de cybers\u00e9curit\u00e9 (\u201cNIS2 Act\u201d).<\/p>\n

Under Article 14(5), following receipt of an initial notification of a significant incident, the competent authority provides the notifying entity with an initial response and, at the entity\u2019s request, guidance or operational advice on the implementation of possible mitigation measures. Such guidance is provided by the competent authority in cooperation with the relevant Computer Security Incident Response Team (\u201cCSIRT\u201d), which may also provide additional technical support at the entity\u2019s request.<\/p>\n

The rulebooks are intended to translate this operational guidance into practical and readily usable resources, helping entities facing a cybersecurity incident to rapidly identify and implement appropriate mitigation measures and to facilitate their interaction with the competent authority and the relevant CSIRT.<\/p>\n

 <\/p>\n

Who are they intended for?<\/strong><\/p>\n

The rulebooks are primarily intended for public and private sector entities subject to the NIS2 Act. They provide operational guidance for handling cybersecurity incidents, in particular in the context of a significant incident notified to the competent authority in accordance with the notification mechanism established by the NIS2 Act.<\/p>\n

They are especially relevant for technical teams, cybersecurity officers and other staff responsible for incident handling and response.<\/p>\n

The rulebooks may also serve as a practical reference for other organisations facing a cybersecurity incident or seeking to prepare and improve their incident response procedures.<\/p>\n

 <\/p>\n

What do the rulebooks provide?<\/strong><\/p>\n

The rulebooks provide practical, step-by-step guidance for handling specific types of cybersecurity incidents. Each rulebook addresses a particular incident scenario and structures the response across the main stages of incident handling.<\/p>\n

Depending on the type of incident, the guidance covers:<\/p>\n