Circular CSSF 22/804 is a CSSF circular, published 31 March 2022. Subject: Update of Circular CSSF 21/769 on governance and security requirements for Supervised Entities to perform tasks or activities through telework.
\nRelevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, Crowdfunding service providers, Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Investment funds and vehicles, Management companies - Chapter 15, Management companies - Chapter 16, Mortgage credit intermediaries, Other specific authorisations, registrations and information, Part II UCIs, Payment institutions, Payment institutions/electronic money institutions/AISPs, Pension funds, Securitisation undertakings, SICARs, SIFs, Specialised PFS, Support PFS, UCITS, Virtual asset service providers (VASPs).
\nKeywords: Central administration, Cybersecurity, Data protection, Information and communications technology (ICT), Information security, Internal governance.
\nAmends Circular CSSF 21/769.
\nCircular CSSF 22/804 RE: Update of Circular CSSF 21/769 on governance and security requirements for Supervised Entities to perform tasks or activities through Telework Luxembourg, 31 March 2022
\nLadies and Gentleman, To all supervised entities
\nYours faithfully,
\nFrançoise KAUTHEN
\nClaude MARX
\nAttachements :
\nCircular CSSF 21/769 RE: Governance and security requirements for Supervised Entities to perform tasks or activities through telework
\nLuxembourg, 9 April 2021 31 March 2022
\nLadies and Gentleman, This Circular defines the governance and security requirements with respect to
\nTo all supervised entities
\nthe implementation and utilisation by an entity under the supervision of the CSSF of work processes based on telework solutions. It contributes to the sound and prudent management, the proper organisation of these supervised entities and the preservation of information security by providing guidance on the requirements the supervised entities have to comply with. No approval by the CSSF is required in order to implement, maintain or extend telework solutions for staff in a supervised entity. This circular applies under normal general working conditions. It does not apply under pandemic situations (for example COVID-19) or in case of other exceptional circumstances having a comparable impact on the general working conditions. This Circular is limited to financial sector regulatory requirements. All contractual relations between supervised entities and their employees are out of scope of this Circular. It does not create any precedence for rights or obligations on whether telework may be implemented by entities under the supervision of the CSSF. Furthermore, this Circular does not interfere in any legal provisions that are part of the mandatory public policy provisions (règles d’ordre public) or part of the Luxembourg Labour Code. It is intended solely to provide additional guidance on the governance and security requirements to be followed when implementing telework solutions for employees of entities supervised by the CSSF.
\nTABLE OF CONTENTS I. II.
\nIII. IV. V. VI.
\nVII.
\nVIII.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}