The NIS2 directive significantly widens the scope of companies subject to cybersecurity obligations. Many Luxembourg SMEs are now in scope without necessarily knowing it.

Our governance & security consultants recommend starting with three workstreams: an inventory of assets and data flows, a gap analysis against the directive's requirements, and a remediation plan prioritised by risk.

Want a status report? Our free infrastructure audit is a good place to start.