← All cheat sheets

CSSF LUXEMBOURG REGULATORY QUICK REFERENCE

Plain-text reference · 6 KB. Read it, search it (Ctrl-F) or print it.

CSSF OVERVIEW#

Commission de Surveillance du Secteur Financier (CSSF)
Luxembourg's financial sector supervisory authority
Website: https://www.cssf.lu
eDesk Portal: https://edesk.cssf.lu

KEY CSSF CIRCULARS FOR IT/SECURITY#


            

                        

                
CIRCULAR 12/552 - CENTRAL ADMINISTRATION#

                
Scope: All regulated entities
Key requirements:
- Central administration must be in Luxembourg
- Effective substance requirements
- Board oversight of IT and operations
- Internal control framework
- Compliance function requirements

            

                        

                
CIRCULAR 17/654 - OUTSOURCING (SUPERSEDED)#

                
Replaced by Circular 22/806
Historical reference for outsourcing arrangements

            

                        

                
CIRCULAR 20/750 - ICT RISK MANAGEMENT#

                
Scope: Credit institutions, investment firms, PSFs
Key requirements:
- ICT governance framework
- ICT risk management policy approved by board
- ICT risk assessment methodology
- ICT security policy
- ICT operations management
- ICT project management
- ICT business continuity management
- ICT change management
- Quarterly ICT risk reporting to management body
- Annual ICT risk assessment review
- Incident management and reporting

            

                        

                
CIRCULAR 22/806 - OUTSOURCING#

                
Scope: All regulated entities
Key requirements:
- Pre-outsourcing risk assessment
- Critical vs non-critical distinction
- Prior notification to CSSF for critical outsourcing
- Contractual requirements (SLA, audit rights, exit)
- Sub-outsourcing controls
- Outsourcing register (maintained and reported)
- Exit strategy for critical arrangements
- Cloud-specific requirements
- Ongoing monitoring of service providers
Notification: Via eDesk for material outsourcing

            

                        

                
CIRCULAR 24/847 - CLOUD COMPUTING#

                
Scope: Entities using cloud services
Key requirements:
- Cloud risk assessment
- Data classification before cloud adoption
- Contractual requirements with CSPs
- Exit strategy and portability
- Data location awareness
- Encryption requirements
- Multi-cloud and vendor lock-in considerations
- Regular testing of cloud controls
- Incident reporting for cloud incidents

            

                        

                
CIRCULAR 25/893 - DORA IMPLEMENTATION#

                
Scope: Financial entities subject to DORA
Key requirements:
- Alignment with DORA Regulation (EU 2022/2554)
- ICT asset inventory update
- Enhanced incident reporting (eDesk)
- TLPT framework alignment (TIBER-LU)
- Third-party register reporting
- Information sharing arrangements
- Transitional provisions and timelines

            

                        

                
eDESK PORTAL#

                
- Central reporting platform for CSSF submissions
- Accessible at https://edesk.cssf.lu
- Used for:
  - Incident notifications (initial 4h, intermediate 72h, final 1 month)
  - Outsourcing notifications
  - Third-party register submissions
  - Regulatory reporting
  - Ad-hoc communications with CSSF

            

                        

                
INCIDENT REPORTING TIMELINES#

                
Initial notification:   4 hours after classification as major
Intermediate report:    72 hours after initial notification
Final report:           1 month after incident resolution

Classification criteria for major incidents:
- Number of clients affected
- Duration of incident
- Geographic spread
- Data losses
- Impact on critical/important functions
- Economic impact

            

                        

                
IT OUTSOURCING REQUIREMENTS#

                
Pre-outsourcing:
1. Risk assessment
2. Due diligence on provider
3. CSSF notification (critical/important functions)
4. Board approval

Contractual minimums:
- Clear scope and SLA definitions
- Audit and access rights
- Data protection clauses
- Sub-outsourcing controls
- Business continuity requirements
- Termination and exit provisions
- Data location and jurisdiction
- Incident notification obligations

Ongoing:
- Regular performance monitoring
- Annual review of arrangements
- Updated outsourcing register
- Report changes to CSSF

            

                        

                
PROFESSIONAL OBLIGATIONS#

                
PSF (Professionals of the Financial Sector):
- Support PSF: IT operators, communication agents
- Specialized PSF: domiciliation agents, registrar agents
- Must maintain CSSF authorization
- Capital and insurance requirements
- Annual reporting obligations
- AML/CFT compliance

            

                        

                
COMMON CSSF AUDIT FINDINGS#

                
1. Insufficient ICT risk documentation
2. Outdated BCP without recent testing
3. Missing or incomplete outsourcing register
4. Lack of formal change management process
5. Insufficient board-level ICT reporting
6. Missing exit strategies for critical providers
7. Inadequate access management reviews
8. Incomplete incident classification procedures
9. Missing data classification scheme
10. Insufficient vulnerability management program

            

                        

                
CSSF INSPECTION PREPARATION#

                
Before inspection:
- Review all circulars applicable to your entity
- Update ICT risk register and assessment
- Verify outsourcing register is complete
- Ensure BCP was tested in last 12 months
- Prepare board meeting minutes showing ICT oversight
- Verify incident log is up to date
- Check access reviews are documented
- Prepare organizational chart for ICT function
- Document all third-party ICT arrangements
- Ensure eDesk access is active and current

During inspection:
- Designate single point of contact
- Provide requested documents promptly
- Be transparent about gaps
- Document all requests and responses

            

                        

                
CSSF AND DORA ALIGNMENT#

                
DORA (EU 2022/2554) applies from 17 January 2025
CSSF is the competent authority for:
- Credit institutions
- Investment firms
- Payment institutions
- Electronic money institutions
- PSFs

CSSF adaptations:
- Circular 25/893 implements DORA specifics
- eDesk updated for DORA incident reporting
- TIBER-LU framework for TLPT
- Third-party register collection via eDesk
- Coordination with ESAs (EBA, EIOPA, ESMA)

            

                        

                
KEY CONTACTS#

                
CSSF General:     (+352) 26 251-1
CSSF IT Risk:     Contact via eDesk
CIRCL Luxembourg: https://www.circl.lu
CNPD (Data Protection): https://cnpd.public.lu
ILR (NIS2 authority): https://web.ilr.lu

            

                    

                
        
Defensive reference on CyberRamen. Offensive / red-team sheets live on
            OffensiveRamen.com.