Recital 65
Digital Operational Resilience Act · UE 2022/2554
| (65) | The conduct of such monitoring should follow a strategic approach to ICT third-party risk formalised through the adoption by the financial entity’s management body of a dedicated ICT third-party risk strategy, rooted in a continuous screening of all ICT third-party dependencies. To enhance supervisory awareness of ICT third-party dependencies, and with a view to further supporting the work in the context of the Oversight Framework established by this Regulation, all financial entities should be required to maintain a register of information with all contractual arrangements about the use of ICT services provided by ICT third-party service providers. Financial supervisors should be able to request the full register, or to ask for specific sections thereof, and thus to obtain essential information for acquiring a broader understanding of the ICT dependencies of financial entities. |
In Luxembourg, the CSSF is the competent authority for DORA and anticipated these requirements through CSSF circular 22/806 on outsourcing arrangements, which already required a register of ICT outsourcing agreements. The circular remains applicable and stacks with DORA: Luxembourg financial entities must therefore reconcile their existing 22/806 register with the 15 templates of the ESAs RTS (delegated regulation 2024/1773), to avoid inconsistent dual reporting.
Luxgap practice: we systematically perform a cross-mapping between your current CSSF 22/806 register and the target DORA format, to avoid duplication and ensure consistency across both filings.
