LexLint.ioBeta

Know the law your code answers to.

Law / Luxembourg

Loi du 1er juillet 2024, DORA Competent Authorities, Sanctions and ICT Continuity Duties of Financial Firms

Art. 5 et 20-21 à 20-25, Loi du 1er juillet 2024 (Mémorial A n° 271)

In force since .

A sector security regimes rule binding public and private bodies.

Obligation class
Security, Governance

As of .

What it requires

  • If you are a CRR institution in Luxembourg, keep adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, and establish, manage and test them in accordance with Article 11 of the DORA Regulation (Loi du 1er juillet 2024, Article 5).NIST CSF 2.0ID.IM-04
  • If you are a person supervised by the CSSF or the CAA under the DORA Regulation, stop conduct that breaches it when ordered and do not repeat it, and do not obstruct the authorities' supervisory powers or give them inaccurate or incomplete information (Articles 20-24 and 20-23).NIST CSF 2.0GV.OC-03

These lines are LexLint's reading of the law's text, as of .

In the frameworks

NIST Privacy Framework
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
  • PR.PO-P8Response and recovery plans are tested.
NIST CSF 2.0
  • GV.OC-03Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
  • ID.IM-04Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
CIS Controls
  • 3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
  • 3.10Encryption of sensitive data as it crosses networks.
  • 3.11Encryption of sensitive data where it is stored on servers and applications.
  • 6.8Access rights defined by job role, and kept up to date.
  • 7.1A documented, reviewed approach to finding and handling weaknesses.
  • 8.2Turning on and gathering logs from the enterprise's systems.
FINOS AIGF
7 more
ENISA NIS2 guidance
  • 1.1Policy on the security of network and information systems
  • 1.2Roles, responsibilities and authorities
  • 2.1Risk management framework
  • 2.2Compliance monitoring
  • 3.1Incident handling policy
  • 3.2Monitoring and logging
7 more
  • 4.1Business continuity and disaster recovery plan
  • 6.2Secure development life cycle
  • 6.5Security testing
  • 6.10Vulnerability handling and disclosure
  • 9.1Cryptography
  • 11.2Management of access rights
  • 12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Private right of actionNo

Penalty structure

Article 20-24(2), point 4 sets an administrative fine on a legal person of at most 5,000,000 euro or up to 10 percent of total annual turnover; a natural person is fined at most 5,000,000 euro.

Rule
Higher of
As of
Currency
EUR
Fixed cap
5,000,000
Turnover percentage cap
10

Who enforces it

Enforcement body

The Commission de surveillance du secteur financier (CSSF) and the Commissariat aux assurances (CAA), the competent authorities under Article 20-22, each for the persons it supervises.

Settledness

As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Commission de surveillance du secteur financier (CSSF) and the Commissariat aux assurances (CAA) are the competent authorities in Luxembourg under Article 46 of the DORA Regulation (Regulation (EU) 2022/2554), each for the persons it supervises (Article 20-22).

CRR institutions must have adequate contingency and business continuity policies and plans, including ICT business continuity policies and plans and ICT response and recovery plans, which they establish, manage and test in accordance with Article 11 of the DORA Regulation (Article 5, inserting Article 53-21(2)).

For a breach of the DORA Regulation provisions the law lists, the CSSF and the CAA may order the person to stop and not repeat the conduct, order the cessation of a practice, fine a legal person up to 5,000,000 euro or up to 10 percent of its annual turnover, fine a natural person up to 5,000,000 euro, and make a public statement (Article 20-24).

They may fine from 250 to 250,000 euro a person who obstructs their supervisory powers, ignores their orders or knowingly gives them inaccurate or incomplete information (Article 20-24(3)). Their decisions may be challenged within one month before the administrative tribunal, which rules on the merits (Article 20-25). The law entered into force on (Article 26).

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app