Unpacking compliance, security and AI.
Our DPOs and CISOs regularly share their take on regulatory and technical news here: new CNPD guidelines, notable sanctions, incident lessons learned, evolutions on the AI Act, NIS 2 and DORA. To go beyond the press release.
31 articles found · #cssf
DORA: TLPT RTS now in force — what the CSSF expects
Delegated Regulation (EU) 2025/1190 sets TLPT under DORA. In Luxembourg, the CSSF is the TLPT authority and aligns TIBER‑LU. Who gets designated, how testing works, and cadence: a practical brief.
DORA: CSSF tightens major ICT incident reporting
CSSF releases additional operational instructions for DORA major ICT incident reporting. Deadlines, content and data quality are tightened, aligning with the EU framework.
CSSF 25/892: quantifying ICT incident costs — adopt 3‑2‑1‑1‑0 immutable backups
Since 28/05/2025, the CSSF requires annual aggregated estimation of costs/losses from major ICT incidents (JC 2024 34). Immutable, isolated 3‑2‑1‑1‑0 backups cut financial impact and provide the required evidence.
NIS 2: authentication logs as evidence (Conseil d’État)
The Conseil d’État validated purpose‑bound access to authentication logs. To meet NIS 2 (24h) and CSSF expectations, a Logging + SIEM + Forensics setup is now essential.
DORA Art. 28: Register of Information — CSSF expectations for 2026
The CSSF opened eDesk and set a DORA Register of Information submission window from 11 February to 31 March 2026. Content is standardized by ITS (EU) 2024/2956 and subject to strict validation rules.
Council of State upholds CNIL authorisation for HDH: cloud impact and proof of compliance
On 20/03/2026, France’s Council of State upheld CNIL’s authorisation for the Health Data Hub hosted on Azure in France. Key takeaway: use CSPM to evidence compliance with GDPR, NIS 2 and CSSF 22/806.
NIS 2 vs DORA in Luxembourg: notify in 24 h or 4 h?
Verifiable fact: CSSF Circular 25/893 (27/05/2025) aligns DORA reporting with a first notification “within 4 hours” after classification. NIS 2 requires a preliminary alert “within 24 hours.” Key issue: who to notify, when, and against which clock in Luxembourg.
CSSF 25/903: Support PSF — the inventory/CMDB as key evidence
CSSF 25/903 strengthens 24/850 and requires structured evidence on support PSF ICT organization. An automated inventory/CMDB becomes central to trace assets, dependencies and controls, and to meet NIS 2 obligations.
European Commission: Europa.eu breach — how a CSPM prevents the next one
On March 27, 2026, the European Commission confirmed data exfiltration from its cloud hosting Europa.eu. Here’s how a CSPM evidences compliance (GDPR Art. 32, CSSF 22/806) and prevents a repeat.
CSSF 26/906: strengthened governance and risk — an ISO 27001 ISMS to evidence NIS 2
CSSF 26/906 tightens governance and risk for payment/e-money institutions, with compliance due by 30 June 2026. A certified ISO 27001 ISMS operationalizes these requirements and NIS 2 Article 21.
CSSF 26/904: stronger ICT evidence — inventory/CMDB becomes essential
CSSF Circular 26/904 tightens investment firms’ self‑assessment by requiring concrete evidence on ICT organization. An automated inventory and a relational CMDB are the most reliable way to demonstrate effective control.
CSSF 26/914: AMLA supervision — the ICT inventory becomes vital
CSSF 26/914 identifies entities eligible for AMLA’s direct supervision. Governance and traceability tighten: a reliable, continuous inventory/CMDB is now essential to evidence NIS 2/ISO 27001 controls.