How to comply with article II.1 of CSSF 22/806?

Question

I need to bring my Luxembourg organisation into compliance with article II.1 of CSSF 22/806 (CSSF 22/806). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapCSSF Circular 22/806 separates classic ICT outsourcing from cloud-based outsourcing, but the most common trap is believing this chapter only covers large IT subcontracting deals. In practice, the CSSF sanctions institutions that never mapped their non-cloud ICT outsourcing (third-party managed on-premise hosting, application maintenance, level 3 support, software vendors with remote access), meaning no criticality assessment, no contractual clauses compliant with points 59 and 60, and no up-to-date register. The EBA/GL/2019/02 guidelines have required this register since 2019, and DORA (Regulation EU 2022/2554) tightened it from 17 January 2025 through the ICT third-party register, aligned by CSSF Circular 25/883.What blocks you in a CSSF inspectionConfusing ICT outsourcing with a simple license purchase: as soon as a third party operates, maintains or accesses your systems, it is outsourcing subject to chapter 1.Failing to assess the criticality or importance of the outsourced function before signing, as required by points 59 and 60.Incomplete contractual clauses: no audit right, no CSSF access right, no cascading sub-outsourcing clause, no documented exit strategy.A static outsourcing register kept on Excel, never reconciled with real contracts and payment flows.Forgetting support PFS (articles 29-3, 29-5, 29-6 of the LFS) which are themselves ICT providers to the financial sector.No tested exit strategy: the CSSF checks you can reinternalise or switch provider without operational disruption.How Luxgap automates this riskOur Luxgap ICT Outsourcing Sentinel makes shadow ICT outsourcing impossible by automatically detecting every provider that operates or accesses your systems, even those missing from your official register. The tool cross-references your Sage BOB 50 entries, your Odoo contracts, the privileged access in your Active Directory and your Microsoft Defender logs to rebuild the real map of your non-cloud ICT outsourcing, without any officer filling in a form.Detects every active ICT provider as soon as a remote access, a recurring payment or a maintenance contract appears in your connected systems.Classifies each outsourced function against the criticality grid of points 59 and 60 of the circular and flags critical or important functions in the DORA sense.Verifies the presence of mandatory clauses (audit right, CSSF access, sub-outsourcing, exit strategy) and alerts on contracts not compliant with the EBA/GL/2019/02 guidelines.Generates and maintains the DORA register of information aligned with CSSF Circular 25/883, ready to submit to the CSSF.Alerts in real time via Teams whenever a new ICT provider obtains undeclared privileged access.Produces a timestamped, sealed PDF report, admissible during a CSSF inspection, proving control over your outsourcing chain.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepa...

Chapitre 1 - Dispositifs d’externalisation en matière de TIC

They trust us

Before we chat