En collaboration avec:
Description
Introduction
Cloud services and ICT third-party providers have become structural to the financial sector. They move part of the control environment outside the institution without moving the responsibility for it. The cloud officer function, now broadened to third-party risk management (TPRM), has to combine command of the regulatory framework, security requirements and contractual oversight across the whole life of an arrangement.
Objectives
At the end of the course, the participants must be able to:
• fulfil the role of cloud officer, TPRM officer and outsourcing officer
• apply the framework in force: DORA, the CSSF circulars and the CAA circular letters
• assess whether a function is critical or important and derive the resulting obligations
• articulate data protection, professional secrecy and ICT requirements
• evaluate the risks of outsourcing arrangements and cloud service models
• apply cloud security, access management and business continuity principles
• conduct provider due diligence using the CSA Cloud Controls Matrix and CAIQ
• manage the full lifecycle: notification, register, contract, monitoring and exit
Programme
Module 1 — Role and responsibilities (3 hours)
• Introduction
– Defiitions
◦ Cloud officer
◦ Outsourcing officer
◦ TPRM officer and resource operator
– Responsibilities
– Hierarchical structure and positioning within the three lines of defence
– Interfaces with the CISO, the DPO, compliance, risk management and internal audit
Module 2 — Regulatory framework (12 hours)
• Introduction: architecture of the applicable framework and hierarchy of texts
• DORA — Regulation (EU) 2022/2554
– Overview: scope and proportionality (Chapter I), ICT risk management (Chapter II), incident management and reporting (Chapter III), digital operational resilience testing (Chapter IV), information sharing (Chapter VI)
– Chapter V — managing ICT third-party risk: strategy, policy, register of information, due diligence and selection criteria
– Preliminary assessment of concentration risk and subcontracting chains
– Mandatory contractual provisions and enhanced requirements for critical or important functions
– Oversight framework for critical ICT third-party service providers and consequences for the client financial entity
– Related technical standards: ICT services policy, register of information templates, subcontracting
– Determining whether a function is critical or important: methodology and traceability of the decision
• CSSF Circular 25/882 — use of ICT third-party services
– Scope, entities covered and exemptions
– Access to data covered by professional secrecy; specific regime for providers established in Luxembourg
– Daily backup of accounting and client positions where the accounting system is hosted outside Luxembourg
– Prior notification and register of information: obligations and levels of consolidation
– Cloud computing services: essential characteristics retained by the CSSF, provider staff access to data and the annual audit of such access, automated resource management, designation and competences of the cloud officer
• CSSF Circular 22/806, as amended by Circular 25/883 — outsourcing
– Respective scope: Part II not applicable to entities within the scope of DORA, Part I applicable to business process outsourcing
– Law governing the contract and location of data and resilience: requirements in force
– General principles: governance, proportionality and sustainability (ESG)
– Governance, assessment of arrangements and the outsourcing process
– Position of management companies under Article 125-1 of the UCI Law
• CSSF Circulars 25/881 and 20/750 for entities outside the scope of DORA; Circular 21/769 by cross-reference
• Insurance sector — Commissariat aux Assurances (CAA)
– Division of supervisory competence between the CSSF and the CAA; consequences for bancassurance groups and for providers serving both sectors
– Circular Letter 21/15 — outsourcing to cloud service providers: transposition of the EIOPA guidelines, content of the notification to the CAA, local expertise and competences, information security function, insurance secrecy
– Circular Letter 22/16 — outsourcing of critical or important operational functions and activities: assessment criteria, prior notification to the CAA, outsourcing register, contractual requirements under Delegated Regulation (EU) 2015/35, role of the compliance key function holder
– Circular Letter 25/1 — practical implementation of DORA: major incident reporting and submission of the register of information
– Articulation between DORA, Solvency II and the CAA circular letters
• GDPR and data protection
– Qualifying the roles: controller, processor, sub-processor
– Processing agreements under the GDPR and their articulation with the contractual requirements of DORA
– Transfers outside the European Union, standard contractual clauses and impact assessment
– Record of processing activities and register of information: points of overlap
– Articulation with banking professional secrecy
• Decision matrix: which text, which supervisor and which obligations, by entity and type of service
• Next steps
Module 3 — Cybersecurity, policies, processes and risk management (9 hours)
• Introduction
– Cybersecurity domains
◦ Governance and strategy
◦ Risk management
· Basics of risk management
· Risk management of the arrangements: ICT outsourcing, cloud and business process outsourcing
◦ Information security
· Policies and processes
· Identity and access management
· Cryptography
· Examples of cloud security solutions
◦ ICT governance
◦ Business continuity management
· Link with DORA Chapter IV: the resilience testing programme and the inclusion of providers
• Next steps
Module 4 — Outsourcing, TPRM and technologies (8 hours)
• Cloud service and delivery models overview
• Cloud solution providers: Amazon Web Services and Microsoft Azure
– Security principles and application
– Shared responsibility model
• Cloud Security Alliance frameworks
– Cloud Controls Matrix and CAIQ: structure, control domains, current version
– STAR programme: self-assessment, third-party certification or attestation, continuous monitoring; using the public STAR registry
– Mapping CCM controls to the contractual and security requirements of DORA and of the circulars
– Positioning against ISO/IEC 27001, 27017 and 27018, SOC 2 reports and the EU Cloud Code of Conduct
– Exercise: reviewing a CAIQ, identifying gaps and framing follow-up questions to the provider
• Cascade outsourcing: organisational and compliance aspects
– Delegated Regulation (EU) 2025/532 on subcontracting of ICT services supporting critical or important functions
• Other use cases: outsourced SOC, hosting, application development
Module 5 — Practical implementation (8 hours)
• Supervisory notification, step by step
– CSSF route: current form, three-month notice period reduced to one month for authorised support PFS, consequence of a late or non-compliant notification
– CAA route: notification form and one-month notice period for insurance and reinsurance undertakings
• Register of information: template structure, identifiers, consistency checks, eDesk submission and handling of error messages
• Governance alignment and proportionality
• Documentation framework: strategy, policy and procedures
• Lifecycle management of arrangements
• Contract administration: service levels, audit and access rights, data location, termination
• Identification and review of critical or important functions
• Exit strategy and reversibility
• Monitoring process: indicators, periodic review, management of provider incidents, escalation to the management body
• Wrap-up case study and guided revision
Target audience
• Cloud officers, TPRM officers, outsourcing officers, resource operators and their deputies
• ISOs and CISOs, risk officers, compliance officers, business continuity managers, project managers
• Procurement and vendor management leads, legal counsel handling ICT service contracts
Within credit institutions, investment firms, support PFS, payment institutions, fund managers, insurance and reinsurance undertakings, insurance intermediaries and other financial sector professionals.
Conditions
Support de cours
-
Des supports de cours seront disponibles après les modules respectifs
-
Die Kursunterlagen werden nach den jeweiligen Modulen zur Verfügung gestellt
-
Course materials will be made available after the respective modules
Exam
The knowledge acquired in the seminar will be validated through an examination. The examination is based on a MCQ questionnaire of around 30 questions. The required passing rate is 60%.
Certificate
At the end of the training, a certificate of attendance will be available either on your client account or on demand to the customer service.
Candidates who successfully complete the examination will receive the following certificate of completion co-signed by the ABBL: "Certified Cloud Officer & Outsourcing Officer"
Location
L-1615 Luxembourg
Luxembourg
Sessions et horaires
-
Mon 09.11.2026
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Tue 10.11.2026
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Wed 11.11.2026
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Thu 12.11.2026
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Fri 13.11.2026
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Fri 13.11.2026
17:30 à 19:30
2H
Cloud Officer & Outsourcing Officer - Certified programme
Classe virtuelle
-
Mon 12.04.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Tue 13.04.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Wed 14.04.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Thu 15.04.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Fri 16.04.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Fri 16.04.2027
17:30 à 19:30
2H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Mon 15.11.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Tue 16.11.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Wed 17.11.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Thu 18.11.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Fri 19.11.2027
08:30 à 17:30
8H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
-
Fri 19.11.2027
17:30 à 19:30
2H
Cloud Officer & Outsourcing Officer - Certified programme
Chambre de Commerce Luxembourg
Vous souhaitez rester à jour sur notre offre de formation ?
Inscrivez-vous à la newsletter