Circular CSSF 21/769 is a CSSF circular, published 31 March 2022 and updated 9 April 2021. Subject: Governance and security requirements for supervised entities to perform tasks or activities through telework.
\nRelevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, Crowdfunding service providers, Crypto-Assets Service Providers (CASPs), Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Issuers of ARTs, Issuers of E-Money Tokens (EMTs), Issuers of Tokens, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Payment institutions/electronic money institutions/AISPs, Pension funds.
\nKeywords: Central administration, Cybersecurity, Data protection, Information and communications technology (ICT), Information security, Internal governance.
\nAmended by Circular CSSF 22/804.
\nCircular CSSF 21/769 RE: Governance and security requirements for Supervised Entities to perform tasks or activities through telework
\nLuxembourg, 31 March 2022
\nLadies and Gentleman, This Circular defines the governance and security requirements with respect to
\nTo all supervised entities
\nthe implementation and utilisation by an entity under the supervision of the CSSF of work processes based on telework solutions. It contributes to the sound and prudent management, the proper organisation of these supervised entities and the preservation of information security by providing guidance on the requirements the supervised entities have to comply with. No approval by the CSSF is required in order to implement, maintain or extend telework solutions for staff in a supervised entity. This Circular is limited to financial sector regulatory requirements. All contractual relations between supervised entities and their employees are out of scope of this Circular. It does not create any precedence for rights or obligations on whether telework may be implemented by entities under the supervision of the CSSF. Furthermore, this Circular does not interfere in any legal provisions that are part of the mandatory public policy provisions (règles d’ordre public) or part of the Luxembourg Labour Code. It is intended solely to provide additional guidance on the governance and security requirements to be followed when implementing telework solutions for employees of entities supervised by the CSSF.
\nTABLE OF CONTENTS Scope Definitions Telework Staff or staff member Employer’s premises or premises Privileged users Critical activities Authorised Management III. General principles IV. Compliance with other legal provisions V. Baseline requirements VI. Internal organisation and internal control framework Risk management Telework policy Monitoring of the use of Telework Controls by internal control functions over Telework VII. Requirements related to ICT and security risks Policies and procedures Risk awareness Access rights Remote access devices Telework infrastructure Security of connections Review of the communication chain security Technology watch Logging VIII. Entry into force, review and anti-abuse provision I. II.
\n4 4 4 5 5 5 5 5 6 6 7 8 8 9 10 10 10 11 11 11 12 13 13 14 14 14 15
\nI. Scope 1.
\nThis Circular applies to all supervised entities, hereinafter collectively referred to as “Supervised Entities” or individually as “Supervised Entity”, including their branches in Luxembourg or abroad, to the extent that telework is authorised in the countries where the branches are established and they comply with national regulations. In this context, specific requirements stated in this Circular apply as minimum standards to be adopted by branches of Supervised Entities.
\nThis Circular also applies to Luxembourg branches of entities originating from outside the European Economic Area.
\nLuxembourg branches of entities originating from a Member State of the European Economic Area may also use telework in accordance with the requirements provided for in this Circular, in case telework is authorised in their home country. These branches and their head offices shall ensure that the use of telework by the Luxembourg based branches also complies with all national rules and regulations applicable in the home Member State.
\nII.
\nDefinitions Telework 4. Telework is a form of organising and/or carrying out work, using information and communication technologies within the framework of an employment contract authorising work, which would ordinarily be carried out on the employer's premises, to be performed outside the premises of the employer. 5.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}