New CSSF circular 17/654 on cloud computing and other IT outsourcing recent regulatory changes

Transcription

1 New CSSF circular 17/654 on cloud computing and other IT outsourcing recent regulatory changes September 21 st, 2017 David Hagen, CSSF CSSF - Circulaire cloud et outsourcing IT 1

2 Introduc+on Why this circular? «Cloud workstream» in 2016 Conclusion: Need to clarify CSSF expecta+ons w.r.t. cloud outsourcing Crea+on of a CSSF circular 17/654 on cloud outsourcing («cloud circular») Modifica+on of the exis+ng regulatory framework 2

3 Circular on cloud compu)ng Objec+ves Take account of cloud specifici+es in the context of an outsourcing Dis+nguish the provisioning of a cloud from the no+on of opera+ng in the sense of Support PFS (29-3 and 29-4) Maintain Support PFS s par+culari+es and clarify their role in a cloud context Stay compa+ble as far as possible with the work done at EBA level (TFIT) 3

4 Table of contents - Cloud Circular Defini+ons Specific vocabulary Defini+on of Cloud Compu+ng (7 criteria) Applicability of the circular Requirements to be observed (terms coming from the CSSF circular 12/552 and adapted to the cloud) Resource opera+on Governance Client no+fica+on and consent No+fica+on to the CSSF / authorisa+on by the CSSF Management of outsourcing risks Business con+nuity Systems security Contractual clauses Monitoring of ac+vi+es Right to audit 4

5 Cloud vs not cloud: which circular applies? Previously, 2 circulars: CSSF 12/552 (sub-chap. 7.4), for credit ins+tu+ons and investment firms (IF). CSSF 05/178, for payment ins+tu+ons, e-money ins+tu+ons and PFS others than IF. Now, circulars: Does this IT outsourcing meet the 7 criteria of the cloud circular? If yes, the cloud circular applies instead of respec+vely the sub-chap. 7.4 of CSSF circular 12/552, or of the CSSF circular 05/178 => 17/656 (abolishes and replaces the 05/178) If not, the 2 CSSF circulars 12/552 and 17/656 (ex 05/178) remain applicable respect. to the types of en++es concerned. 5

6 Defini+on of cloud compu)ng: 7 criteria Cloud defini+on (and glossary) based on a recognised terminology (NIST, ENISA) 5 criteria / features: on-demand self-service, broad network access, resources pooling, rapid elas+city and measured service Cloud defini+on based on 2 addi+onal criteria Apart from excep+onal situa+ons, the provider does not access the data and systems of the ISCR (i.e. the consumer) without its prior consent and without monitoring mechanism available to the ISCR No manual interac+on of the provider as regards the day-to-day management of resources 6

7 Example of a resource provisioning interface 7

8 Defini+on of roles Signatory (of the contract with the cloud service provider) Consumer (of resources) è modified in «ISCR», Ins+tu+on Supervised by the CSSF and Consuming cloud compu+ng Resources for the purpose of carrying out its ac+vi+es Resource Operator Cloud compu:ng Service Provider (CSP) => The cloud circular takes up the obliga+ons of the 12/552, but should be read according to the role played by the regulated en+ty 8

9 Direct outsourcing to CSP CSSF regulated entity ISCR (consumer) Resource Operator Signatory In Luxembourg or abroad CSP Entity supervised by the CSSF Entity not supervised by the CSSF Cloud Officer 9

10 CSSF regulated entity Use of a Support PFS ISCR (consumer) Support PFS Resource Operator In Luxembourg or abroad Signatory CSP The resource operator is «reseller» of the CSP cloud and is fully responsible for the CSP s service level quality. CSSF regulated entity ISCR (consumer) Signatory Support PFS Resource Operateur As signatory, the ISCR is responsible of the CSP s service level quality and compliance but can rely on the resource operator s expertise in its assessment of the CSP s service level quality. CSP In Luxembourg or abroad Entity supervised by the CSSF Entity not supervised by the CSSF Cloud Officer 10

11 Indirect outsourcing to CSP through a non regulated en+ty CSSF regulated entity ISCR (consumer) Subcontractor abroad (group or not) or group exemption (art 1. LFS) Resource operator In Luxembourg or abroad Signatory CSP The ISCR must verify that the Operator meets the requirements of the cloud circular and that the Operator has done a due diligence on the CSP covering the cloud circular elements. Entity supervised by the CSSF Entity not supervised by the CSSF Cloud Officer 11

12 Cloud or pseudo-cloud? ISCR (consumer) Subcontractor abroad (e.g. the group) CSSF regulated entity CSSF cloud Resource operator CSSF regulated entity Signatory Subcontractor s cloud ISCR (consumer) CSSF 12/552 Subcontractor abroad (e.g. the group) Resource operator Subcontractor s pseudo-cloud The ISCR (consumer) must assess (with the group) if the cloud solution (of the group) is or is not in the scope of the cloud circular (i.e. meets the 7 criteria of the cloud definition). If the solution does not comply to the definition, there is no signatory in the sense of the cloud circular and consequently the CSSF circular 12/552 remains applicable. 12

13 Data confiden+ality and security Disconnec+on from discussion on art. 41 Encryp+on with localisa+on of the encryp+on keys in Luxembourg is no longer mandatory Reference to legal risks and obliga+ons Consequence in current situa+on: the consent remains necessary if the operator Support PSF The form of the consent is not specified Confiden+ality based on technology and processes by applying key security principles: Need to know Least privilege 13

14 Cloud officer Competencies Is responsible for the use of the cloud compu+ng services and guarantees the competences of the teams Is an employee of the resource operator Shall have the adequate competencies on the product used The ISCR and the CSSF must know the name of the cloud officer A resource operator can have several cloud officers 14

15 Several cloud officers Illustra+on CSSF regulated entity ISCR (consumer) or Resource Operator A B Signatory A B In Luxembourg or abroad CSP A CSP B The ISCR shall make sure it has (a) cloud officer(s) with appropriate knowledge with regards to each CSP. Entity supervised by the CSSF Entity not supervised by the CSSF Cloud Officer 15

16 Several cloud officers Illustra+on CSSF regulated en+ty ISCR (consumer) Subcontractor abroad or group exemption (art 1. LFS) Resource operator Signatory CSP A A B CSP B The ISCR shall make sure the resource operator has (a) cloud officer(s) with appropriate knowledge with regards to each CSP. au Luxembourg ou à l étranger Entity supervised by the CSSF Entity not supervised by the CSSF Cloud Officer 16

17 Con+nuity and contract Adapt con+nuity measures to your needs Load balancing versus fail-over? Back-up of produc+on data Contractual clauses: Service contract under EU law + EU resiliency of the cloud compu+ng services Audit right 17

18 No+fica+on to / Authorisa+on by the CSSF Non material ac+vity => No+fica+on Material ac+vity If the signatory is Support PSF => no+fica+on Other cases => authorisa+on Formalised documenta+on of the risk analysis and of the jus+fica+on of the compliance, point by point, with the circular Authorisa+on => both documents to be provided No+fica+on => wriien confirma+on of the global compliance 18

19 No+fica+on to / Authorisa+on by Termina+on of a cloud outsourcing Prior no+fica+on required Support PSF wishing to offer directly or resell cloud compu+ng services Authorisa+on the CSSF => The informa+on to be transmiied to the CSSF in no+fica+on and authorisa+on files is specified on the CSSF website 19

20 No+fica+on to / Authorisa+on by the CSSF Informa+on to be transmiied to the CSSF 20

21 No+fica+on to / Authorisa+on by the CSSF How to write a good no+fica+on/authorisa+on? Be specific. Avoid statements like the company will comply with this point. For the CSSF, the how is important. Give precise indica+on for any documenta+on of the Cloud Service Provider (CSP). This point is covered by the SOC 2 report of the ISP, chapter x-y-z, document reference n ABC (Give the URL of the document, if possible) If you rely on group opera+ons and cloud, do not let the group answering the ques+on but answer by yourself as regulated en+ty. If the outsourcing is not material and you simply no+fy the CSSF, you s+ll have to do the risk analysis and the point by point analysis but you don t send it to the CSSF. The CSSF might ask you this documenta+on at any +me. Please look at the exis+ng audits, cer+fica+ons and whitepaper of the CSPs or ask for evidence that your group or operator/ signatory did it. 21

22 22

23 Modifica+on of the exis+ng regulatory framework Amendment of the CSSF circular 12/552 (by the CSSF circular 17/655) Sub-chapter Outsourcing To add a reference to the cloud circular To disconnect from the ar+cle 41 of the LFS To abolish the possibility to outsource abroad only to the group To introduce the concepts of «need to know» and «least privilege» Patch management (without link to the cloud circular) A monitoring process (new threats/vulnerabili+es) and a patch management procedure are required Both are to be covered by internal audit 23

24 Modifica+on of the exis+ng regulatory framework (cont d) Abolishment and replacement of the CSSF circular 05/178 by the CSSF circular 17/656 Chapter 1 Copy of the structure and of the terms of the CSSF circular 12/552 as amended (sub-chap. 7.4) With same consequences: disconnec+on from art. 41, «need to know», «least privilege», aboli+on of the possibility to outsource abroad only to the group, except for Support PSF ar+cles 29-3 to 29-6 (cf. chap. 2) 24

25 Modifica+on of the exis+ng regulatory framework (cont d) CSSF circular 05/178 => 17/656 (cont d) Chapter 2: outsourcing possibili+es for Support PSF and their branches (subject previously covered in the CSSF circular 06/240) For opera+ng services (OSIP/OSIS) : possibility to outsource the hos+ng of their infrastructure to the group (or to a local service provider for branches local clients) but condi+ons: CSSF authorisa+on, no opera+ng by the group, consent of Financial ins+tu+ons (FI) if data of FI s final clients is concerned, control by the PFS IT for internal usage: full or par+al outsourcing to a third-party is possible but condi+ons: CSSF no+fica+on, consent of Financial ins+tu+ons (FI) if data of FI s final clients is concerned 25

26 Modifica+on of the exis+ng regulatory framework (cont d) Modifica+on of the CSSF circular 06/240 by the CSSF circular 17/657 Because incompa+bility of the defini+on of opera+ng ac+vity (difference btw Operator and CSP) For all IT outsourcing falling in the scope of the cloud circular, reference to the defini+on of resource opera+on in the cloud circular To remove the paragraphs related to the possibili+es of outsourcing for Support PFS, which are now covered in the CSSF circular 17/656 (ex. 05/178). 26

27 Don t forget! CSSF website Ø List of informa+on to be provided in no+fica+on and authorisa+on files Ø FAQ Ques+ons on the cloud circular to be sent by s to: Ø patrick-laurent.sandbrink@cssf.lu Ø jean.dechillou@cssf.lu 27

28 Thank you for your aien+on! Ques+ons? 28