Handles health records, in Luxembourg

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 11, 12, 13 · Read the law's page

• Take technical, operational and organisational measures appropriate and proportionate to the risks facing the network and information systems you use for your activities or to provide your services, and act to eliminate or reduce the impact of an incident on the recipients of your services and on other services.
• Cover at least: risk analysis and information-system-security policy; incident handling; business continuity, including backup management and crisis management; supply-chain security, including the security of your relationships with direct suppliers and service providers; security in the acquisition, development and maintenance of your systems, including vulnerability handling and disclosure; evaluating the effectiveness of your own risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on cryptography and, where appropriate, encryption; personnel security, access-control policy and asset management; and multi-factor or continuous authentication, secure voice, video and text communications, and secure emergency communication systems as needed.
• Notify the measures you take under this duty to the competent authority in the form, format and timeframe it sets by règlement or circulaire.
• Have your management body approve these risk-management measures, oversee their implementation, and complete regular training on assessing risk and risk-management practice; expect the body to be held liable for the entity's violation of this duty.
• Where you find you are not complying with these measures, take, without undue delay, all necessary, appropriate and proportionate corrective measures.
• This binds an entité essentielle (essential entity) or entité importante (important entity) under Article 11, which reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and you are named in Annexe II point 6 as an online-marketplace provider, an online-search-engine provider or a social-networking-services-platform provider, or where you are a public-administration entity under Annexe I point 10; the wider sector classes Annexe I and Annexe II also reach (energy, transport, health, digital infrastructure, ICT-service management, banking and financial-market infrastructure among them) are reached too, by declaring that you are an essential or important entity.

Loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Art. 14 · Read the law's page

• Notify the competent authority, without undue delay, of any incident with a significant impact on the provision of your services: treat an incident as significant where it has caused or is capable of causing severe operational disruption or financial loss to you, or considerable material, physical or moral damage to another person.
• Submit an early warning within 24 hours of becoming aware of the significant incident, stating whether it is suspected to result from unlawful or malicious acts or could have cross-border effect.
• Follow with a fuller incident notification within 72 hours of becoming aware, updating the early warning and giving an initial assessment of the incident's severity and impact and, where available, indicators of compromise.
• Submit an intermediate report if a CSIRT or the competent authority requests one, and a final report within one month of the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report within one month of the handling of the incident (Article 14, paragraph 4).
• Where appropriate, notify the recipients of your services, without undue delay, of a significant incident likely to affect the services they receive from you, and of any measures or corrections they can apply in response to a significant cyber threat.
• If you are a trust-service provider, notify a significant incident affecting your trust services within 24 hours of becoming aware of it, in place of the 72-hour incident notification; the early warning, the intermediate report and the final report still apply.
• This binds an entité essentielle or entité importante under Article 11, which reaches you where you qualify as at least a medium-sized enterprise under the EU size-cap rule (Commission Recommendation 2003/361/EC) and you are named in Annexe II point 6 as an online-marketplace provider, an online-search-engine provider or a social-networking-services-platform provider, or where you are a public-administration entity under Annexe I point 10; the wider sector classes are reached as on this jurisdiction's companion risk-management row.