CSSF 13/554 Compliance

As per the CSSF circular 13/554, it is required that a NON-Luxembourgish financial institution system administrator doesn’t get empowered with the possibility to bypass the existing security mechanisms and gain access to the confidential resources via centralized administration tools. The Circular 13/554 also requires several safeguards to be implemented by the financial institution aspiring to rely on a group-level Active Directory.

According to the circular, the compliant approach to mitigate the risk of foreign administrators would be to prevent the non-Luxembourg administrator employees from being able to edit the overall configuration of the Luxembourg branch Active Directory domain. The CSSF 13/554 also demands from the Luxembourg financial institutions the ability to centrally manage user access privileges and deploy baseline security policies which ensure that the right people have access to the right information at all the time. As specified in the circular 13/554, any financial institution wishing to use a group-level Active Directory is required to:

• Introduce a formal and detailed authorization request to the CSSF. This document needs to demonstrate that the obligation of a permanent full control by the financial institution over the resources under its responsibility and over the corresponding accesses to these resources is always fulfilled.

• Set-up, configure and maintain a tool which will prevent the push of non-approved domain policy / configuration changes, before its implementation.

• Set-up, configure and maintain corrective controls in case the preventive controls are down. The financial institution has to explain the technical feasibility of the chosen corrective controls in its authorization request. These controls can correspond to log reviews and/or audit tools or gap analysis tools.   To perform this operation and achieve compliance,  CSSF 13/554 recommends to implement a “preventive tool” that provides the next functions:

• The tool must have its own internal AT (Access Tool) policy. The internal policy configured must be the exact digital transposition of the approved AT policy.
• The tool locally controls the  AT policy of the local branch by systematically comparing a local branch AT policy change request (push) to the tool internal policy.

• In case a policy is pushed and it contains a change that is not in line with the tools internal policy, the push must be blocked.