In the context of the Luxembourg law of 5 May 2026 implementing the NIS2 cybersecurity framework [1], new operational guidance was published on 28 September 2026 to help organisations respond to malicious cyber incidents.

The Operational Guidance for Incident Handling (the “Guidance”) [2] was jointly published by the National Cybersecurity Agency (“ANSSI”), the financial sector supervisory authority (“CSSF”), the Computer Incident Response Center Luxembourg (“CIRCL”), the governmental incident response team (“GovCERT”), the High Commission for National Protection (“HCPN”) and the Luxembourg Regulatory Institute (“ILR”), (collectively the “Authorities”).

Scope of the Guidance

The Guidance is a practical tool for organisations facing a malicious cyber incident. It consists of a general triage and routing framework followed by eight incident-specific rulebooks covering:

• denial-of-service attacks,
• malware (including ransomware),
• attacks through communication channels (such as phishing),
• theft of credentials and compromised accounts,
• exploitation of vulnerabilities,
• insider threats,
• data exfiltration, and
• attacks affecting the IT supply chain.

Human error and system failures remain outside the Guidance’s scope.

The Guidance does not replace internal policies and procedures and, importantly, does not address the legal obligations triggered by a cyber incident (e.g. filing a complaint or notifying the CSSF, the ILR or the CNPD), and these remain to be assessed separately.

Five key legal takeaways

• Start the reporting clock at triage. The Guidance requires mandatory reporting timelines (such as NIS2, Digital Operational Resilience Act (“DORA”) and sector-specific rules) to be considered immediately at triage. The corresponding legal analysis should therefore run in parallel with the technical response from day one.
• A cyber incident may also be a personal data breach. Where personal data is exfiltrated, the Guidance recommends coordinating with the Data Protection Officer (“DPO”), with an express reference to the General Data Protection Regulation (“GDPR”). Whether or not the breach must be notified to the Luxembourg data protection authority (“CNPD”) or to data subjects remains subject to a legal assessment for the DPO, compliance and legal teams.
• Do not pay any ransom. For ransomware incidents, the Guidance states that organisations should not pay the ransom as payment does not guarantee recovery and may breach national, EU or international sanctions law.
• Insider investigations must respect employees’ rights. For insider threats, monitoring and evidence gathering should use approved tools and procedures but must also comply with applicable laws and internal policies. Human resources and legal teams should therefore be involved from the outset.
• Prepare external support and contracts. The Guidance recommends rapidly onboarding internal or external cyber experts, consultants and legal counsel where needed, and considering early contact with external incident-response teams or the cyber-insurance provider where contractual arrangements exist. For IT supply-chain incidents, it also recommends reviewing vendor risk, and considering contractual security clauses and “kill-switch” rights allowing an organisation to disable a product, update or data flow.

Next steps for organisations

The Guidance is only as effective as an organisation’s preparation. We recommend checking that incident-response procedures provide for rapid escalation, evidence preservation, timely involvement of legal, compliance and HR teams, and early assessment of reporting obligations, as well as reviewing cyber-insurance policies and IT supplier contracts now rather than during a crisis.

—

[1] Law of 5 May 2026 on measures aimed at ensuring a high level of cybersecurity and amending the amended Law of 14 August 2000 on electronic commerce, the amended Law of 23 July 2016 establishing a High Commission for National Protection, and the Law of 17 December 2021 on electronic communications networks and services.

[2] Operational Guidance For Incident Handling published on 28 September 2026.

To read more about our practice: Media, Data & Technologies