Key Updates On CSSF Circulars On ICT Risk Management And ICT Outsourcing/Use Of ICT Third Parties

On 9 April, the CSSF issued four new circulars:

• Circular CSSF 25/880 on relationship management of payment service users and PSP ICT assessment
• Circular CSSF 25/881 amending Circular CSSF 20/750 on information and communication technology (ICT) and security risk management
• Circular CSSF 25/882 setting out requirements for the use of ICT third-party services by financial entities falling under the scope of the Digital Operational Resilience Act (DORA)
• Circular CSSF 25/883 amending Circular CSSF 22/806 on outsourcing arrangements

As highlighted in the CSSF's communiqué of the same date, these new circulars introduce key changes to existing frameworks, aligning with the entry into force of DORA. They affect not only financial entities subject to DORA, but also other entities supervised by the CSSF.