How to comply with article M.4 of CSSF 25/881?

Question

I need to bring my Luxembourg organisation into compliance with article M.4 of CSSF 25/881 (CSSF 25/881). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThis amendment removes entire sections of Circular CSSF 20/750 because their content is now covered by DORA and its technical standards. The trap: believing that a removed section means a vanished obligation. In reality, the CSSF transferred these requirements to the DORA framework, which is stricter and directly applicable. Entities that keep relying on internal documents referencing sections 1 to 4 of the 20/750 end up with an outdated compliance baseline, exposed during a CSSF review of ICT risk management.What the CSSF checks after this removalThe disappearance of these sections creates a risk of documentary misalignment: your internal policies often explicitly cite the removed paragraphs. The CSSF sanctions the gap between your displayed framework and the DORA framework actually applicable.Section 1 (ICT and security risk management) is replaced by DORA articles 5 to 15 on the ICT risk management framework.Section 2 (amendment of CSSF 12/552) and Section 4 (additional PSP requirement) are absorbed into the DORA corpus and its RTS.Section 3 (repeal of CSSF 19/713 on cloud) shifts to the information register and ICT third-party contractual requirements of DORA (article 28 onwards).Your internal procedures, charters and control matrices must remove any reference to the repealed sections and point to the equivalent DORA articles.The register of critical ICT providers becomes the central piece of evidence expected by the CSSF.How Luxgap automates this riskOur Luxgap Regulatory Delta Tracker makes it impossible to steer on an outdated baseline: it automatically detects every obsolete reference to CSSF 20/750 in your documentary corpus and remaps it to the equivalent DORA article. A specialised LLM agent reads your ICT policies, security charters and procedures stored in SharePoint M365, Confluence or Odoo, then flags the paragraphs citing removed sections.Scans your entire compliance documentation through M365, SharePoint and Confluence connectors to spot references to the repealed sections 1 to 4.Automatically remaps each removed requirement to the matching DORA article (articles 5 to 15, article 28 on ICT third parties).Generates a prioritised documentary update plan, with the exact list of paragraphs to rewrite and the DORA replacement text.Rebuilds your ICT provider information register in the format expected by the CSSF, cross-referenced with your Odoo contracts and vendor flows.Produces a timestamped PDF report enforceable before the CSSF, demonstrating the full alignment of your ICT framework with DORA after Circular 25/881.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams prepare a demonstration on your real documentary corpus, with a free blank audit within 48h to measure your exposure before any commitment.

Amendment 2 — the sections removed

They trust us

Before we chat