Outsourcing Criticality Assessment

The Outsourcing Criticality Assessment answers the first question in any CSSF 22/806 outsourcing file: is the arrangement critical or important? It works through the framework of points 15–20 — the rule-based triggers of point 18 that make a function critical or important by default, and, where those don't decide it, the materiality assessment — capturing the lettered sub-point answers as you go. Every conclusion is reconciled point-per-point against the circular, down to the sub-points, so the determination is traceable rather than asserted. If the arrangement is an ICT service of a DORA financial entity, the tool routes out — DORA and Circular CSSF 25/882 govern instead — and points you to the Regime Classifier to qualify it there. The output is a reconciliation memo plus register-ready values (points 54–55) you can paste straight into your outsourcing register, or into the IddiLabs Outsourcing Register. It runs entirely in the browser: nothing is stored or sent, and it exports to Excel, a printable memo, an AI-extract Markdown file, and a JSON working file.

• The point 18 rule-based triggers plus the materiality route, worked through in order
• Lettered sub-point answers captured for every relevant point
• A point-per-point reconciliation memo against CSSF 22/806, down to the sub-points
• A DORA route-out for ICT arrangements of financial entities, linking to the Regime Classifier
• Register-ready values (points 54–55) to drop into the outsourcing register
• Excel, printable memo, AI-extract Markdown and JSON export — plus a save/resume working file
• Fully browser-based — nothing is stored or sent

Under CSSF Circular 22/806, whether a function is "critical or important" is the gate that decides how much of the circular applies — the notification, the register content, the contractual safeguards, the audit rights. Get it wrong and everything downstream is scoped wrong. The test lives in points 15–20: some functions are critical or important by rule under point 18, others turn on a materiality judgement, and the reasoning has to be documented well enough for internal audit to reperform it under point 52. This tool encodes that framework: it applies the point 18 triggers, captures the sub-point answers, and produces a determination reconciled point-per-point against the circular, with register-ready values at the end. It is the entry point to the outsourcing tool chain — its point 20 screen takes the residual tier from the Risk Assessment, and it links on to the Due Diligence and the Contract Clause Gap Checker.