Luxembourg essential entities must file cyber measures by 15 March via SERIMA

Essential entities supervised by the Institut Luxembourgeois de Régulation must notify the cybersecurity risk-management measures required by Article 12(1) and (2) of the Law of 5 May 2026 on a high level of cybersecurity.Public The notification comprises a description of the measures in place, an analysis of the main cyber-risk scenarios linked to the entity activity or service provision, and a multi-year action planPublic, with any additional information the Institut requests supplied within the deadline set in that request.

The description covers fourteen domains: management-body commitment and accountability; network and information-system security policy; risk-management policies; incident management; business continuity and crisis management; supply-chain security; security of acquisition, development and maintenance of networks and information systems; policies and procedures to assess the effectiveness of the risk-management measures; basic cyber hygiene and information-security training; cryptography; human-resources security; access control; asset management; and environmental and physical security. Detail and scope appear in the Institut document titled Mesures, updated on the Institut website and accessible via https://www.serima.lu/mesures.

The risk analysis states, for each main scenario, the assessed impact level, the assessed likelihood of occurrence, the risk treatment and the residual risk level. A list of generic scenarios to analyse appears in the Institut document titled Analyse des principaux scénarios de risques cyber on the same page, and the Institut may add sector- or entity-type-specific scenarios.

The multi-year plan lists ongoing or planned actions that raise the cybersecurity level and address findings from the description and the risk analysis. For each action it states the concrete action, the risk scenario or scenarios mitigated, the measure or measures addressed, the target implementation date, the role responsible for execution and the priority for implementation.

Essential entities also recorded as critical entities within the meaning of Article 2(1) of the Law of 5 May 2026 on the resilience of critical entities must additionally file a list of dependencies on direct suppliers or service providers.Public A dependency exists where the activity of the entity or the provision of its own service or services requires recourse to one or more other entities.

Notification is due each year no later than 15 MarchPublic, even where nothing has changed since the previous notificationPublic, and again on each significant change in the risk level, identification of a new major risk or implementation of particularly important security measuresPublic. It is filed through the SERIMA platform at https://www.serima.lu or any other secure means the Institut deems equivalentPublic, in a format the Institut can process.

Legal basis is Article 12(3), Article 21(1) and Article 22(2) of the Law of 5 May 2026 concerning measures to ensure a high level of cybersecurity, and Article 2(1) of the Law of 5 May 2026 on the resilience of critical entities.Public Règlement ILR/N26/10 of 26 October 2026Public repeals Règlement ILR/N22/7 of 15 September 2022 and Règlement ILR/N22/8 of 26 September 2022.