I need to bring my Luxembourg organisation into compliance with recital 1 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapRecital 1 sets the DORA philosophy: digital resilience is no longer an isolated IT topic, it must be embedded in the broader operational framework of the financial entity. The CSSF already sanctions firms that treat ICT risk as a technical annex to their business continuity plan, without governance, without dependency mapping, without measurement of business impact. CSSF thematic reviews in 2024-2025 show that most Luxembourg financial entities have a fragmented view of their ICT exposure, especially on cascading subcontracting chains (cloud on cloud, business SaaS hosted on AWS/Azure, payroll providers connected to the core banking system).What this recital concretely changes in your governanceDigital operational resilience becomes a governance pillar at the same level as credit or liquidity risk, no longer a sub-domain of operational risk.The management body must be able to demonstrate that it understands the critical ICT dependencies of each business line (private banking, funds, payments, custody).The ICT asset map must be alive, cross-referenced with business criticality and subcontracting chains, not an annual Excel inventory.Cyber threats and ICT disruptions must be treated with equal rigor: an internal non-malicious incident (outage, misconfiguration) falls within DORA's scope just as much as an attack.Integration into the broader operational framework implies documented links with the BCP, the risk appetite framework, the ICAAP/ORSA and the outsourcing policy under CSSF 22/806.How Luxgap automates this riskOur Luxgap Resilience Fabric materializes in real time the actual ICT dependency of each critical business process of your financial entity, and turns the intent of recital 1 into a map that can be presented to the CSSF. The tool pulls automatically from your existing sources (Active Directory, Microsoft Defender, Azure Sentinel, AWS Config, LuxConnect/eBRC configuration, Odoo contracts, CSSF 22/806 outsourcing register) and rebuilds the full chain asset -> ICT service -> critical business function, without asking your CISO to fill in a single spreadsheet.Automatically detects new ICT dependencies as soon as a cloud service, a business SaaS or a provider appears in your financial flows, your logs or your contracts.Classifies each ICT asset by criticality for critical financial functions within the meaning of article 3(22) DORA, by crossing the business matrix with actually observed flows.Calculates a digital resilience score per business line and per critical function, comparable from quarter to quarter for the management committee.Sends real-time alerts on Teams or Slack in case of a broken chain (undocumented 4th-tier subprovider, ISO 27001 certification about to expire, non-compliant cloud region).Produces a cryptographically sealed time-stamped PDF report, presentable during a CSSF on-site mission, that demonstrates the integration of digital resilience into the broader operational framework.Available in addition...

Recital 1 DORA — Recital 1 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 1

Digital Operational Resilience Act · UE 2022/2554

(1)

In the digital age, information and communication technology (ICT) supports complex systems used for everyday activities. It keeps our economies running in key sectors, including the financial sector, and enhances the functioning of the internal market. Increased digitalisation and interconnectedness also amplify ICT risk, making society as a whole, and the financial system in particular, more vulnerable to cyber threats or ICT disruptions. While the ubiquitous use of ICT systems and high digitalisation and connectivity are today core features of the activities of Union financial entities, their digital resilience has yet to be better addressed and integrated into their broader operational frameworks.

Luxembourg specificity

loi luxembourgeoise du 1er juillet 2024 portant mise en oeuvre du reglement (UE) 2022/2554 (DORA) et circulaire CSSF 24/847

In Luxembourg, the CSSF is the competent authority for DORA across the regulated financial sector, and the law of 1 July 2024 implementing the DORA regulation explicitly designates the CSSF and the CAA as supervisory authorities depending on the type of entity (CSSF-supervised financial entities on one side, insurance and reinsurance undertakings and insurance intermediaries under the CAA on the other). CSSF circular 24/847 on ICT incident reporting completes the framework and articulates with CSSF circular 22/806 on outsourcing.

Luxgap practice: linking the DORA mapping to your CSSF 22/806 outsourcing register from day one avoids duplicate data entry and ensures consistency between both exercises during an on-site review.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 1 sets the DORA philosophy: digital resilience is no longer an isolated IT topic, it must be embedded in the broader operational framework of the financial entity. The CSSF already sanctions firms that treat ICT risk as a technical annex to their business continuity plan, without governance, without dependency mapping, without measurement of business impact. CSSF thematic reviews in 2024-2025 show that most Luxembourg financial entities have a fragmented view of their ICT exposure, especially on cascading subcontracting chains (cloud on cloud, business SaaS hosted on AWS/Azure, payroll providers connected to the core banking system).

What this recital concretely changes in your governance

Digital operational resilience becomes a governance pillar at the same level as credit or liquidity risk, no longer a sub-domain of operational risk.
The management body must be able to demonstrate that it understands the critical ICT dependencies of each business line (private banking, funds, payments, custody).
The ICT asset map must be alive, cross-referenced with business criticality and subcontracting chains, not an annual Excel inventory.
Cyber threats and ICT disruptions must be treated with equal rigor: an internal non-malicious incident (outage, misconfiguration) falls within DORA's scope just as much as an attack.
Integration into the broader operational framework implies documented links with the BCP, the risk appetite framework, the ICAAP/ORSA and the outsourcing policy under CSSF 22/806.

How Luxgap automates this risk

Our Luxgap Resilience Fabric materializes in real time the actual ICT dependency of each critical business process of your financial entity, and turns the intent of recital 1 into a map that can be presented to the CSSF. The tool pulls automatically from your existing sources (Active Directory, Microsoft Defender, Azure Sentinel, AWS Config, LuxConnect/eBRC configuration, Odoo contracts, CSSF 22/806 outsourcing register) and rebuilds the full chain asset -> ICT service -> critical business function, without asking your CISO to fill in a single spreadsheet.

Automatically detects new ICT dependencies as soon as a cloud service, a business SaaS or a provider appears in your financial flows, your logs or your contracts.
Classifies each ICT asset by criticality for critical financial functions within the meaning of article 3(22) DORA, by crossing the business matrix with actually observed flows.
Calculates a digital resilience score per business line and per critical function, comparable from quarter to quarter for the management committee.
Sends real-time alerts on Teams or Slack in case of a broken chain (undocumented 4th-tier subprovider, ISO 27001 certification about to expire, non-compliant cloud region).
Produces a cryptographically sealed time-stamped PDF report, presentable during a CSSF on-site mission, that demonstrates the integration of digital resilience into the broader operational framework.

Available in addition to a Luxgap CISO mandate or as a dedicated SaaS module depending on your regulated scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free 48-hour blank audit to measure your DORA exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 1

They trust us

Before we chat