On 9 April 2025, the CSSF released four circulars and two
communiqués in relation to DORA, which concern all entities
supervised by the CSSF, regardless of whether or not they fall
within the scope of DORA.
1. Update of Circular CSSF 20/750 on ICT and security risk
management and publication of a new circular
Due to the overlap of Circular CSSF 20/750 on ICT and security
risk management with DORA, some updates have been made to this
Circular.
As a result, the scope of Circular CSSF 20/750 is amended,
leading to the deletion of some parts of Circular CSSF 20/750 by
Circular CSSF 25/881 and their introduction in a new CSSF Circular
25/880.
Thus, from now on, Circular CSSF 20/750 as amended by Circular
CSSF 25/881 applies to i.a. all support and specialised
professionals of the financial sector, and third-country branches
of (i) credit institutions, (ii) investment firms, (iii) payment
institutions and (iv) electronic money institutions. The
requirements set