Whether it’s a tornado, floods, a power failure or an internet blackout, Luxembourg must be able to continue functioning. The examples of the cyberattack on Post and the Proximus blackout throw a harsh light on the need to significantly improve resilience--even in the middle of summer and when everyone is on holiday, even when everything is finally back up and running in four hours.
Let’s untangle the threads of “who does what?” for the country’s strategic resilience.
- Reporting directly to the prime minister, the High Commission for National Protection (HCPN) is in charge of the physical resilience of critical entities in the expected transposition of the European Critical Entities Resilience Directive (CER). It oversees the implementation of resilience plans, the identification of critical entities in non-financial sectors and the notification of non-cyber incidents. “This protection extends to all sectors of activity and covers all risks likely to affect the smooth running of socio-economic life,” it says.
- The Financial Sector Supervisory Commission (CSSF) is also designated in the same CER bill. It is meant to supervise critical entities within the financial sector, including certain digital operators if they are linked to the financial sector (stock exchanges, clearing houses, payment infrastructures, etc.).
- The Luxembourg Regulatory Institute (ILR) should be the authority approached as part of the transposition of the Nis2 directive, which deals specifically with cybersecurity.
However, some critical entities (an energy supplier or a bank, for example) come under both the CER Directive and the Nis2 Directive... and therefore under two authorities. For physical and organisational resilience, it would be the HCPN (or the CSSF); for cyber resilience, it would be the ILR (or the CSSF, also for the financial sector). It’s up to the regulators to work together to avoid entities from slipping through the cracks.
Eleven areas concerned
In his 2016 book “Black Out,” the Austrian author Marc Elsberg recounts how, on a cold winter’s evening, the European electricity grid begins to fail. Many countries were plunged into darkness and several nuclear power stations put the lives of millions of people at risk. Terrorist threat or technical failure? Piero Manzano, an Italian ex-hacker, thinks he knows who is responsible. With the help of a French Europol policeman, François Bollard, the hacker embarks on a race against time against an adversary who is as cunning as he is invisible.
The book highlights the areas covered by the Critical Entities Resilience Directive:
- energy (electricity, oil, gas, hydrogen, heat networks);
- transport (air, rail, road, inland waterways, including public transport);
- banking (essential banking infrastructure);
- financial market infrastructure (e.g. trading platforms and payment systems);
- health (hospitals and healthcare providers, suppliers of critical drugs and medical devices, pharmaceutical R&D);
- drinking water (supply and distribution of drinking water);
- wastewater (collection and treatment of wastewater);
- digital infrastructure (electronic communications networks, data centres, internet services);
- public administration (state administrations, excluding sovereign sectors of national security, defence, police--the latter may be excluded from the scope according to the directive);
- space (ground-based space infrastructure operators, like satellite control centres);
- food (companies involved in the production, industrial processing or wholesale distribution of essential foodstuffs).
Let’s complicate things a little further. Neither of the two texts has been transposed into Luxembourg law. The local version of the CER was submitted late (just a few weeks before the 2023 legislative elections and having incurred the wrath of the Council of State as recently as last May). Nis2 was on the agenda very soon after the new government was installed, thanks to the new prime minister, 
Critical player switches
Questioned separately, the HCPN and the ILR asked for 72 hours to reply. In a response delivered via the prime minister’s spokeswoman, they said that “designated critical infrastructure operators (CIOs) have been tasked with drawing up a Business Continuity and Security Plan (BCSP), in accordance with the Grand Ducal Regulation of 21 February 2018. This plan includes in particular: the identification, analysis and assessment of risks, the implementation of risk reduction measures, preventive strategies aimed at strengthening the resilience of CI.”
While prime minister Frieden said last week after the Post cyberattack that the HCPN was not issuing any recommendations to critical operators, the HCPN replied this week that “after receiving and analysing the PSCAs, the HCPN issues recommendations to the ICOs in order to optimise the security, resilience and crisis management of these infrastructures. For security reasons, the specific measures contained in the PSCAs are not made public.”
When asked about the fact that another critical operator went--the day after the Post outage--to set up connectivity at one of the historical operator’s competitors, the HPCN said that “following the cyber incident on 23 July 2025, the HCPN contacted the ICOs to exchange information as a precautionary measure. To date, no official notification has been received. It should be emphasised that certain CIs do not necessarily depend on the smooth operation of the internet.” In other words, this player “forgot” to report that it had reviewed its security and business continuity plan. It is not really at fault since the 2018 text does not provide for any deadlines or penalties and this is one of the major problems, as underlined by the Council of State.
Fines or collaboration
As soon as the directive is adopted, critical players will have to notify the authorities about this type of incident. In the event of non-compliance, they will be subject to a scale of penalties ranging from a reprimand to a maximum of €250,000 for breaches of certain targeted articles (in particular articles on risk assessment or notification obligations). They may be subject to a penalty payment of up to €250 per day, while everything is put back in order.
It’s the stick in a system where the carrot does not exist. “In a context of constantly evolving cyber risks, close collaboration between the players involved remains essential,” conclude the HCPN and the ILR. And the events of the last few days have made it possible, out of sight, to measure the collaboration between the players affected or those with expertise, even among competitors. It’s a reason for hope. This is something that is unique to Luxembourg, due to the size of the country and the proximity of the players involved. But it absolutely must be strengthened further.
This article was originally published in French.
