Explore our latest insights, strategic frameworks, and practical advice for navigating the modern threat landscape. If you want to discuss any of these topics in more detail, contact us.
ISO/IEC 42001 and the EU AI Act do not call for a second GRC programme. Start with the controls you already run under ISO/IEC 27001, Luxembourg's NIS2 Act, DORA and GDPR. Reuse what fits; add what is genuinely AI-specific.
Read article →Threat-Led Penetration Testing sits at the demanding end of DORA's testing regime: intelligence-led red-team testing of live production systems. This article explains what DORA Chapter IV and the TLPT technical standards require, how Luxembourg authorities oversee in-scope entities, what a cycle involves, and which first-cycle readiness gaps to address.
Read article →Article 12 of Luxembourg's NIS2 Law asks whether your security measures are appropriate, proportionate and working in practice — a higher bar than owning a firewall and a policy PDF. This guide walks through the ten measures, explains where mid-market teams tend to fall short, and shows how an ISO 27001 programme can support compliance without guaranteeing it.
Read article →The EU Cyber Resilience Act, Regulation (EU) 2024/2847, introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market. It is horizontal: it does not target one sector in the way NIS2 or DORA does. It targets the product and the economic activity around that product: manufacturing, importing, distributing, and making products with digital elements available in the EU.
Read article →Cyvalent 360 Cyber Services provides the practitioner capacity to run an ongoing cybersecurity governance programme—from risk and compliance work to management reporting and incident readiness. It is aimed at organisations that need hands-on delivery, with CISOaaS available where senior security leadership is missing.
Read article →DORA's ICT third-party risk rules—Articles 28–30 of Regulation (EU) 2022/2554—have applied directly since 17 January 2025. In Luxembourg, the Law of 1 July 2024 gives the CSSF and CAA the powers needed to supervise and sanction DORA compliance and transposes Directive (EU) 2022/2556. CSSF-supervised DORA entities must also follow the local requirements in Circular CSSF 25/882; CAA-supervised entities follow the CAA's DORA instructions.
Read article →For owners and managing directors of Luxembourg SMEs who have just heard that NIS2 might apply to them — and want to know what they are personally on the hook for before anyone says the word "audit."
Read article →If you run or manage an organisation in Luxembourg, the cyber and resilience rulebook can look crowded: the Luxembourg NIS 2 and critical-entities laws sit alongside directly applicable EU regulations such as DORA, the Cyber Resilience Act and the AI Act. The practical question is not which instrument matters most, but which trigger applies to each legal entity, activity, product or service.
Read article →
