Circular CSSF 24/847 is a CSSF circular on ICT-related incident reporting framework, published 5 January 2024.
\nLegal basis: Law of 5 April 1993 on the financial sector, Law of 15 December 2000 on postal services and postal financial services, Law of 10 November 2009 on payment services and electronic money, Law of 17 December 2010 on undertakings for collective investment, Law of 12 July 2013 on alternative investment fund managers, Law of 15 March 2016 on OTC derivatives and central counterparties, Loi du 17 avril 2018, Loi du 6 juin 2018 relative aux dépositaires centraux de titres, Law of 28 May 2019 on network and information security (NIS), Law of 16 July 2019 implementing the EuVECA, EuSEF and ELTIF regulations, Law of 16 July 2019 on prospectuses for securities, Loi du 17 décembre 2021, Law of 12 November 2004 on anti-money laundering, Law of 30 May 2018 on markets in financial instruments.
\nRelevant for: AIFMs, Central Securities Depositories (CSDs), Credit institutions, Crowdfunding service providers, Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Specialised PFS, Support PFS.
\nKeywords: Cybersecurity, Information and communications technology (ICT), Information security, Operational risk.
\nCircular CSSF 24/847 ICT-related incident reporting framework To all Supervised Entities within the meaning of the following laws, as amended, and regulations as further specified in point 2: -
\nLaw of 5 April 1993 on the financial sector
\nLaw of 15 December 2000 on postal financial services
\nLaw of 10 November 2009 on payment services
\nLaw of 17 December 2010 relating to undertakings for collective investment
\nLaw of 12 July 2013 on alternative investment fund managers
\nLaw of 15 March 2016 on OTC derivatives, central counterparties and trade repositories
\nLaw of 17 April 2018 on benchmarks
\nLaw of 6 June 2018 on Central Securities Depositories
\nLaw of 28 May 2019 on Network and Information Systems
\nLaw of 16 July 2019 on the operationalisation of European regulations in the area of financial services
\nLuxembourg, 5 January 2024 Ladies and Gentlemen, The purpose of this Circular is to introduce a new ICT-related incident reporting framework in order to acquire a better and more structured overview of the nature, frequency, significance and impact of ICT-related incidents, also considering the growing ICT and security risk in the context of a highly interconnected global financial system. The provisions of this Circular are based on Article 53(1) of the Law of 5 April 1993 on the financial sector, as amended (hereafter “LFS”), Article 31(4) of the Law of 10 November 2009 on payment services, as amended (hereafter “LPS”), Article 2 of the Law of 15 December 2000 on postal financial services, as amended, Article 147 of the Law of 17 December 2010 relating to undertakings for collective investment, as amended (hereafter “UCITS Law”), Article 50 of the Law of 12 July 2013 on alternative investment fund managers, as amended (hereafter “AIFM Law”), Article 2(1) of the Law of 15 March 2016 on OTC derivatives, central counterparties and trade repositories, as amended (hereafter “EMIR Law”), Article 2(1) of the Law of 17 April 2018 on benchmarks (hereafter “Benchmark Law”), Article 2 of the Law of 6 June 2018 on Central Securities Depositories (hereafter “CSD Law”), and Article 20-16 of the Law of 16 July 2019 on the operationalisation of European regulations in the area of financial services. According to Article 3 of the Law of 28 May 2019 on Network and Information Systems (hereafter “NIS Law”), the CSSF is also the competent authority in terms of network and information security for the credit institutions and the financial market infrastructures that have been identified as Operators of Essential Services (hereafter “OES”), as well as for Digital Service Providers (hereafter “DSP”) which are already under the supervision of the CSSF (“NIS authority”). The objective of this circular is to lay down the practical details and modalities for the reporting obligations set forth in Articles 8(4), 8(5), 9(1), 11(3) and 11(4) and 12 of the NIS Law and in CSSF Regulation No 24-01
\nrelating to the notification of incidents according to the Law of 28 May 2019 1 (hereafter “CSSF Regulation No 24-01”) regarding specifically Articles 8(5) and 11(3) of the NIS Law. This Circular brings the following changes to the current incident reporting mechanism: •
\nIncreases the incident coverage, currently limited to fraud and incidents due to external computer attacks as per Circular CSSF 11/504, by covering more broadly ICT operational and security incidents while avoiding double reporting for incidents to be notified under other incident notification frameworks.
\nIntroduces reporting based on classification. Supervised Entities will be required to classify ICTrelated incidents based on the criteria indicated in this Circular and to notify to the CSSF the cases where ICT-related incidents are classified as major or significant incidents.
\nIntroduces a new incident reporting notification form.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}