Recital 35
Digital Operational Resilience Act · UE 2022/2554
| (35) | In order to maintain a high level of digital operational resilience for the whole financial sector, and at the same time to keep pace with technological developments, this Regulation should address risk stemming from all types of ICT services. To that end, the definition of ICT services in the context of this Regulation should be understood in a broad manner, encompassing digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis. That definition should, for instance, include so called ‘over the top’ services, which fall within the category of electronic communications services. It should exclude only the limited category of traditional analogue telephone services qualifying as Public Switched Telephone Network (PSTN) services, landline services, Plain Old Telephone Service (POTS), or fixed-line telephone services. |
In Luxembourg, the CSSF is the DORA competent authority for supervised financial entities and has published CSSF circular 24/847 on ICT incident reporting, which aligns with the broad ICT services definition in recital 35. The law of 1 June 2023 implementing the DORA regulation confirms that any failure of an ICT service, including OTT and encrypted messaging used by front office teams, may trigger the major incident notification obligation within 4 hours to the CSSF.
Luxgap practice: start with an exhaustive inventory of over-the-top services (Teams, WhatsApp Business, Signal) used by your traders and relationship managers; this is the CSSF's first angle of scrutiny during 2025 DORA inspections.
