LuxembourgLoi du 20 décembre 2024, Cybersecurity Certification Authority and Vulnerability Notices
Art. 1, 5 et 6, Loi du 20 décembre 2024 (Mémorial A n° 604)
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security, Reporting
As of .
What it requires
- If you hold a European cybersecurity certificate, issue an EU declaration of conformity, or are a conformity assessment body, inform ILNAS in writing within 72 hours of learning of a vulnerability or irregularity that may affect compliance with the security requirements linked to the certification of a product, service or process (Loi du 20 décembre 2024, Article 5(2)).NIST CSF 2.0RS.CO-03
- Give ILNAS access to any document, person, equipment, premises, installation, site and means of transport it needs for its tasks (Article 5(1)).NIST CSF 2.0GV.OC-03
- If you are an accredited conformity assessment body, inform ILNAS of your accreditation and of the certificates you issue within 72 hours (Article 6).NIST CSF 2.0GV.OC-03
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
Who enforces it
Enforcement body
The Institut luxembourgeois de la normalisation, de l'accréditation, de la sécurité et qualité des produits et services (ILNAS), designated by Article 1 as the national cybersecurity certification authority.
Settledness
- As of
What this law does
ILNAS is designated as the national cybersecurity certification authority responsible for the supervision tasks under Article 58 of the Cybersecurity Act (Regulation (EU) 2019/881) and for certification tasks for European cybersecurity certificates at the high assurance level (Article 1).
Holders of European cybersecurity certificates, issuers of EU declarations of conformity and conformity assessment bodies must inform the authority in writing within 72 hours of learning of a vulnerability or irregularity that may affect compliance with the security requirements of the certification of a product, service or process (Article 5(2)).
They must give the authority access to any document, person, equipment, premises, installation, site and means of transport it needs for its tasks (Article 5(1)). An accredited conformity assessment body must inform the authority of its accreditation, and of the certificates it issues, within 72 hours (Article 6). The law entered into force on .
When LexLint raises it
When your app profile says your app distributes a software product.