How to comply with article II.2 of CSSF 22/806?

Question

I need to bring my Luxembourg organisation into compliance with article II.2 of CSSF 22/806 (CSSF 22/806). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe trap of chapter 2 lies in a widespread belief: "the cloud is just another IT vendor". The CSSF specifically sanctions regulated entities that treat a migration to Azure, AWS or Google Cloud as an ordinary ICT outsourcing, without applying the additional specific requirements of chapter 2, aligned with the EBA Guidelines on cloud. The tipping point is subtle: a strictly internal private cloud falls outside the chapter, but as soon as an external provider hosts or operates the infrastructure, the full cloud regime applies. Since DORA came into force on 17 January 2025 and the amendment by CSSF 25/883, the CSSF cross-references these obligations with the ICT information register required by Regulation (EU) 2022/2554.Cloud qualification traps in practiceConfusing a private cloud without outsourcing (out of scope) with a third-party managed private cloud (in scope): operation by an ICT support PSF or a hyperscaler triggers chapter 2.Omitting the location of data and processing, whereas the CSSF requires precise knowledge of storage and processing countries.Neglecting effective audit and access rights, including pooled audits and third-party certifications (ISO 27001, SOC 2 Type II, C5).Underestimating the exit and reversibility strategy, required for any critical or important function hosted in the cloud.Failing to identify the critical or important nature of the outsourced function, which conditions the prior notification to the CSSF.Ignoring the sub-outsourcing chain (cloud region, managed services, sub-processors) and risk concentrations.How Luxgap automates this riskOur Luxgap Cloud Outsourcing Sentinel makes the qualification blind spot impossible: it detects in real time any cloud infrastructure operated by a third party and confronts it automatically with the requirements of chapter 2 of CSSF 22/806 and the EBA Guidelines on cloud. The tool queries your Azure, AWS and Google Cloud consoles, your Microsoft Defender for Cloud and your Active Directory directly to map every cloud service actually active, without waiting for a manager to declare a migration.Automatically detects each newly provisioned cloud service (region, subscription, account) via the AWS Cost Explorer, Azure Resource Graph and Google Cloud Asset Inventory APIs, and distinguishes internal private cloud from third-party operated cloud.Classifies each hosted function as critical or important according to the CSSF and DORA grid, and triggers the CSSF prior notification alert when the threshold is reached.Verifies the presence of mandatory cloud clauses: data location, audit and access rights, reversibility, exit strategy, cascading sub-outsourcing.Instantly alerts on Teams as soon as a new service deploys data in a non-EU region or towards an undeclared sub-processor.Maps risk concentration per hyperscaler and flags excessive dependence on a single provider.Produces a timestamped PDF report enforceable before the CSSF, feeding directly into the ICT informatio...

Chapitre 2 - Dispositifs d’externalisation en matière de TIC

They trust us

Before we chat