Circular CSSF 26/915

  • CSSF Incident Handling Guidance: NIS2 Rulebooks and the DORA Clock

    On 28 September 2026 the CSSF published press release 26/19 announcing operational guidance for incident handling: nine rulebooks written jointly by cybersecurity experts from the High Commission for National Protection (HCPN, acting as ANSSI and as GOVCERT.LU), CIRCL, the CSSF and the ILR. The practical question for Luxembourg DORA entities is whether the CSSF incident…

  • DORA for Third-Country Branches in Luxembourg: Circular CSSF 26/915

    On 27 August 2026 the CSSF issued Circular CSSF 26/915, applicable with immediate effect, to bring specified third-country branches into the CSSF circular framework for DORA. For Luxembourg purposes, the governing scope is the branch perimeter set out in Circular CSSF 26/915 and in each amended circular; the change is not a blanket head-office-only test…