I need to bring my Luxembourg organisation into compliance with article II.5.3.5 of CSSF 20/758 (CSSF 20/758). What are the concrete requirements, the sanctions, and how can Luxgap support me?

EU frameworkGDPR NIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 26/906 CSSF 25/892 CSSF 25/893 CSSF 26/915CSSF 20/758CSSF 18/698 CSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article II.5.3.5

Section 5.3.5 - Le dispositif de gestion de crises

CSSF Circular 20/758 — Central administration, internal governance and risk management (investment firms) · CSSF 20/758

Section 5.3.5. Le dispositif de gestion de crises

96. Le dispositif de gestion de crises repose sur des ressources (ressources humaines, infrastructure administrative et technique et documentation) qui doivent être aisément accessibles et disponibles en cas d’urgence.

97. Le dispositif de gestion de crises comprend, le cas échéant, un plan de redressement qui est conforme aux exigences du chapitre 2 de la partie IV de la LSF.

98. Le dispositif de gestion de crises fait l’objet de tests réguliers et de mises à jour en vue d’assurer et de maintenir son efficacité.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

The CSSF does not sanction the absence of a crisis plan on paper, it sanctions the plan that was never tested and becomes unusable the day an incident hits. The trap in Section 5.3.5 is the duality between the documented arrangement and its real availability: human resources, infrastructure and documentation must be easily accessible in an emergency, which rules out a folder locked inside a server that goes down alongside the IT system. During an inspection, the CSSF asks for evidence of regular testing (minutes, dates, participants, gaps remediated) and for consistency with the recovery plan under chapter 2 of part IV of the LSF.

The evidence the CSSF expects on the crisis management arrangement

An up-to-date crisis directory with roles, deputies and contact details reachable outside the internal network.
Crisis documentation available offline and on a channel independent of the main IT system (the plan must not depend on the system that failed).
A regular testing calendar with varied scenarios (cyberattack, prolonged outage, site loss).
Timestamped minutes of each exercise, with observed gaps and corrective actions tracked.
Consistency with a recovery plan compliant with chapter 2 of part IV of the LSF, where applicable.
Evidence that the arrangement is updated after each test and after each major organisational or technical change.

How Luxgap automates this risk

Our Luxgap Crisis Readiness Vault turns your dormant crisis plan into a living, tested and provable arrangement, eliminating the number one risk: the plan being unavailable on the day it matters. The tool maintains a crisis vault replicated outside the main IT system (independent storage such as eBRC or LuxConnect), syncs the crisis directory from Active Directory and Workday LU, and orchestrates exercises through Teams, without the BCP owner having to re-enter anything.

Automatically replicates crisis documentation to an offline channel independent of the operational IT system, tested for accessibility each cycle.
Syncs the crisis directory (roles, deputies, contacts) from Active Directory and Workday LU and alerts as soon as a key contact leaves the organisation.
Schedules and triggers crisis exercises via Teams using predefined scenarios (cyberattack, site loss, prolonged outage) and timestamps each participation.
Generates the exercise report with observed gaps and a corrective action plan tracked to closure.
Verifies consistency between the crisis arrangement and the recovery plan under chapter 2 part IV of the LSF and flags divergences.
Produces a timestamped and sealed PDF report, admissible to the CSSF during an inspection, demonstrating the regularity of tests and the real availability of resources.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real arrangement, with a free blind audit within 48h to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Section 5.3.5 - Le dispositif de gestion de crises

They trust us

Before we chat