The classic trap
The trap is not failing the test, it is misreading the regulatory chain and assuming a routine annual pentest is enough. The CSSF, the TLPT authority under Article 46 of DORA, sanctions significant entities that confuse a classic penetration test with a genuine threat-led one, or that ignore the TIBER-LU framework run jointly with the BCL. An entity running a test outside the TIBER-EU methodology, without real threat intelligence or a formalised white team, does not meet Article 26 of DORA even if it hired a reputable provider. The result: a non-compliance finding and an obligation to restart the full cycle, which spans several months.
The regulatory stack to master before launching a TLPT
Many Luxembourg financial entities discover too late that TLPT weaves together several texts that must be read as one. Here is the operational reading grid:
- DORA Art. 26-27: sets the TLPT obligation for significant financial entities and requires TIBER-EU alignment.
- RTS 2025/1190: specifies the criteria for identifying in-scope entities, tester requirements, scope, methodology, phases, closure and remediation.
- TIBER-LU (BCL + CSSF, Implementation Document revised on 20 June 2025): the Luxembourg operating manual aligned with the ECB-revised TIBER-EU of 11 February 2025.
- Outsourcing RTS 2025/532 and CSSF circulars 22/806 and 25/882: critical ICT providers fall within the test scope, which many forget.
- CSSF circular 20/750: remediation from the TLPT must feed your ICT risk management, it is not a report left in a drawer.
The most common blind spot: forgetting that scope covers critical functions in live production, not a test environment, and that it includes your significant ICT subcontractors.
How Luxgap automates this risk
Our Luxgap TLPT Readiness Navigator turns the chore of regulatory scoping into a CSSF-defensible roadmap before the test even starts. The tool cross-references your critical-function mapping, your ICT provider register (drawn from Odoo contracts, Microsoft Defender and your DORA register) and the TIBER-LU grid to automatically determine whether you are an in-scope entity, which perimeter to cover and which subcontractors to include.
- Automatically assesses your qualification as a significant entity under RTS 2025/1190 from your prudential indicators and ICT risk profile.
- Maps your critical functions in live production and identifies which ICT providers belong in scope, relying on CSSF circulars 22/806 and 25/882.
- Generates the scoping dossier aligned with the TIBER-LU Implementation Document revised on 20 June 2025, ready to submit to the TIBER-LU Team at the BCL and CSSF.
- Tracks test phases (threat intelligence, red team, blue team, white team) and alerts on any deviation from the required methodology.
- Produces a timestamped remediation register that feeds directly into your ICT risk management under circular 20/750, defensible during an inspection.
Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commitment.
