How to comply with article M.2 of CSSF 25/883?

Question

I need to bring my Luxembourg organisation into compliance with article M.2 of CSSF 25/883 (CSSF 25/883). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapAn amendment to definitions looks trivial, but that is exactly where files fail. By adding the DORA Regulation to the definitions of CSSF 22/806, the CSSF creates a systematic normative cross-reference: every time 22/806 now mentions DORA, the full obligations of Regulation (EU) 2022/2554 apply, with their own sanctions (up to 1% of average daily turnover). Institutions still reading 22/806 in isolation, without mapping cross-references to DORA and CSSF 25/882, miss half of their actual ICT obligations.Practical pitfallsDual framework applicable: 22/806 (outsourcing governance, CSSF regime) + DORA (ICT operational resilience, European regime). Both coexist and complement each other, they do not replace each other.Cloud clauses removed from 22/806 (EEA applicable law, EEA resilience) shift under DORA art. 28 to 30. Your cloud contracts signed before 17 January 2025 must be reviewed.ICT vs non-ICT distinction: an administrative outsourcing service stays under pure 22/806, an ICT service shifts under DORA. Correct qualification is decisive for the applicable regime.Single register impossible: DORA requires an ICT information register per specific RTS, 22/806 requires an outsourcing inventory. Many entities attempt a single Excel file and fail both inspections.Subcontracting chain: DORA art. 29 requires traceability down to the critical ICT sub-subcontractor, a requirement absent from original 22/806.How Luxgap automates this riskOur Luxgap Dual Framework Mapper eliminates the grey zone between CSSF 22/806 and DORA by projecting each supplier contract in real time onto both frameworks simultaneously, and producing two compliant deliverables: the CSSF outsourcing register and the DORA ICT information register, generated from the same source of truth. The tool connects to your contract repository (Odoo, Ironclad, SharePoint), accounting system (Sage BOB 50, SAP) and Active Directory to reconstitute the real mapping of your ICT and non-ICT providers.Automatically classifies each provider as critical ICT / non-critical ICT / non-ICT outsourcing according to DORA art. 3 criteria and the CSSF 22/806 grid, with auditable justification.Generates the ICT information register in DORA RTS format (EU 2024/1773), directly exportable to the CSSF portal, with no rekeying.Detects missing contractual clauses (DORA art. 30, exit, audit, subcontracting, data location) and proposes ready-to-sign addenda.Tracks the full ICT subcontracting chain down to level N+3 via integration with SOC 2 reports and public registers of cloud providers.Alerts the CSSF through automatic notification in case of material change to a critical ICT contract, within DORA-imposed deadlines.Produces a timestamped PDF report, enforceable during an on-site CSSF inspection, demonstrating consistency between both regulatory frameworks.Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our tea...

Amendment 2, definitions of Part I Chapter 1, addition of the DORA Regulation

They trust us

Before we chat