Guidelines for regulated financial entities handling ICT arrangements.
1
Initial Scoping CheckVerify if the vendor provides a digital/data service using ICT systems continuously. Exclude standard analogue telephone services or pure financial services.
2
Critical Assessment (CIF Check)Perform a Business Impact Analysis (BIA) to document if the service supports a Critical or Important Function. This dictates contract strictness.
3
Contract RemediationFor "In Scope" services, draft SLAs, exit strategies, and CSSF-mandated audit rights into the vendor agreement.
4
Register of Information (RoI) EntryConsolidate the assessment outputs and submit them into the standardized CSSF RoI templates for regulatory review.