On 28 September 2026 the CSSF published press release 26/19 announcing operational guidance for incident handling: nine rulebooks written jointly by cybersecurity experts from the High Commission for National Protection (HCPN, acting as ANSSI and as GOVCERT.LU), CIRCL, the CSSF and the ILR. The practical question for Luxembourg DORA entities is whether the CSSF incident…
On 16 September 2026 the three European Supervisory Authorities, the EBA, EIOPA and ESMA, published joint operational instructions for DORA major incident reporting. Short and technical, the document addresses something narrow and, for reporting teams, immediate: how selected fields of the major-incident template are expected or recommended to be populated, so that the data reaching…
If your firm filed a major incident under DORA in 2025, that report has now been counted. On 3 June 2026 the three European Supervisory Authorities published their first annual report on major ICT-related incidents, putting a hard number on what used to be guesswork: how many major incidents the EU financial sector reports, where…