CSSF Circular 22/806 — ICT Risk Management for Luxembourg financial institutions. OneComply supports CSSF-focused governance, outsourcing readiness, circular evidence, and DORA alignment with explicit review boundaries.
CSSF Circular 22/806 is the Luxembourg financial regulator's (Commission de Surveillance du Secteur Financier) circular on ICT risk management. It sets out requirements for how financial institutions supervised by the CSSF must manage their ICT risks.
The circular applies to all CSSF-supervised entities including banks, investment firms, payment institutions, and management companies operating in Luxembourg. It is closely aligned with DORA, so OneComply highlights reusable evidence and the CSSF-specific items that still need review.
Non-compliance can result in CSSF supervisory actions, administrative sanctions, and requirements for corrective measures. The circular requires annual ICT risk self-assessments and periodic CSSF reporting.
35
Controls
7
Sections
DORA
DORA Overlap
CSSF 22/806 closely mirrors DORA ICT risk-management principles, but the overlap should not be treated as automatic legal compliance. OneComply maps reusable evidence and highlights the CSSF-specific requirements for customer and compliance review.
33
Shared with DORA
2
CSSF-specific only
Example improvements when CSSF governance, ICT outsourcing, evidence, and DORA alignment are managed in one workspace. Actual timelines depend on customer data quality and review process.
| Workflow | Manual Process | With OneComply | Time Saved |
|---|---|---|---|
| ICT Risk Framework Documentation | 2–4 weeks (policy drafting) | Guided CSSF template draft | Faster first draft |
| ICT Outsourcing Assessment | 1–2 weeks per provider | 15 minutes (automated assessment) | 95% |
| Governance Structure Mapping | 1–2 weeks (org chart + roles) | 30 minutes (guided wizard) | 95% |
| ICT Change Management Audit | 3–5 days per audit cycle | 10 minutes (automated tracking) | 97% |
| CSSF Reporting Readiness | 1–2 weeks (manual compilation) | Source-data gap checks | Lower rework |
| ICT Incident Classification | 2–4 hours per incident | Instant (automated engine) | 100% |
| Business Continuity Testing | 2–3 weeks (planning + execution) | 2 hours (guided framework) | 90% |
| ICT Asset Inventory | 1–3 weeks (manual cataloguing) | 30 minutes (import + auto-classify) | 95% |
Scoped coverage of CSSF 22/806 sections with 35 mapped controls, ICT risk evidence, outsourcing readiness gates, and CSSF reporting preparation.
8 mapped controls
6 mapped controls
7 mapped controls
4 mapped controls
6 mapped controls
4 mapped controls
Manage Luxembourg ICT risk evidence, outsourcing readiness, and CSSF-aligned review workflows in one workspace.