Government Plan for Cyber and Digital Cyber Management
The Government Plan for Cyber and Digital Crisis Management establishes the overarching framework for the Luxembourg State's preparedness, coordination and response to cyber or digital events that could harm the vital interests or essential needs of all or part of the country or its population. This includes situations such as major technical failure or large-scale attacks against public and/or private sector information and communication technology systems.
This plan builds on the Cyber Emergency Response Plan (PIU Cyber) to ensure continued compliance and resilience against the evolving threat landscape and the national and European regulatory frameworks.
The main objectives of the plan are:
- to strengthen preparedness, prevention and protection against cyber and digital risks;
- to define the governance principles and crisis management bodies necessary for effective national coordination;
- to establish general procedures for responding to and managing crisis situations, as well as the respective roles of the actors involved;
- to establish the framework for disseminating alerts from the authorities and information to the public.
It applies when an event is, or could become, serious enough to require urgent decisions and coordination at the national level and, where appropriate, coordination with European and international crisis management mechanisms.
A cyber or digital emergency refers to an event resulting from a cyber incident or threat that could cause major disruption to – or even the complete unavailability of – information and communication technology systems, affecting or likely to affect the vital interests or essential needs of all or part of the country or population of the Grand Duchy of Luxembourg.
This plan has been drafted and is managed by the High Commission for National Protection (Haut-Commissariat à la protection nationale, HCPN). Its operational execution is within the Government’s remit. Depending on the nature and severity of the situation, relevant ministries, administrations and governmental departments are involved in cooperating to achieve defined goals, in accordance with the mandate of each stakeholder.
National and european framework
The plan is integrated into the national crisis management framework coordinated by the High Commission for National Protection (HCPN) and is aligned with European frameworks for cybersecurity and crisis management, in particular:
- Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, known as the NIS 2 Directive;
- The Council Recommendation of 6 June 2025 on an EU blueprint on cybersecurity crisis management ("Cyber Blueprint");
- European crisis cooperation and coordination mechanisms such as the Integrated Political Crisis Response (IPCR) and the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe).
This positioning ensures consistency between Luxembourg’s response and European approaches, in particular when cyber crises extend beyond national borders.
National classification of cybersecurity incidents
To ensure a rapid, proportionate and coordinated response, the national framework distinguishes between:
- Large-scale cross-border cybersecurity incident: an incident resulting in disruptions that exceed Luxembourg's response capabilities or which significantly impact at least one other Member State or third country;
- Large-scale national cybersecurity incident: an incident resulting in disruptions detrimental to the vital interests or essential needs of all or part of the country or population, requiring urgent decisions and coordination;
- Significant incident: an incident which݉
- has caused, or is capable of causing, severe operational disruption to services or financial loss for the entity concerned;
- has affected, or is capable of affecting, other natural or legal persons by causing considerable material or non-material damage.
- Incident: an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems.
This classification is used to assess the scale of the incident and adapt the mode of cooperation and level of mobilization of the involved actors.
Last update