The classic trap
The most common mistake on Article T.3 is appointing an internal red team for budget convenience, without obtaining prior authorisation from the CSSF (TLPT authority under Article 26 of DORA) or documenting its independence from the tested functions. The CSSF and the BCL, within the TIBER-LU framework, mainly sanction disguised self-testing: a team testing systems it usually administers or audits, expired certifications, missing liability insurance, or a threat intelligence provider that is in fact a subsidiary of the tester. The costliest trap remains reusing the same internal tester for two consecutive TLPTs, an explicit prohibition that retroactively invalidates the test's legitimacy.
The tester eligibility conditions the CSSF actually checks
- Up-to-date individual certifications of the red team members (recognised offensive credentials such as CREST, OSCP, GIAC), with proof of non-expiry.
- Demonstrated experience on threat-led tests in real production environments, not only in labs.
- Professional liability insurance explicitly covering offensive operations on critical functions.
- Absence of conflict of interest: the tester must not have designed, operated or audited the targeted critical functions.
- For internal testers: formal authorisation from the TLPT authority, demonstrated organisational separation, and a mandatory external threat intelligence provider.
- Rotation: an internal tester cannot serve two consecutive TLPTs, requiring multi-year traceability of missions.
In Luxembourg, the TIBER-LU Implementation Document revised on 20 June 2025 conditions test acceptance on this demonstration of independence, and the final remediation feeds TIC risk management under CSSF circular 20/750. TIC providers within the test scope also fall under circulars 22/806 and 25/882 and the outsourcing RTS 2025/532.
How Luxgap automates this risk
Our Luxgap Tester Eligibility Vault makes it impossible to appoint a non-compliant tester by turning manual credential checks into an eligibility file that is opposable to the CSSF. The tool aggregates certifications, insurance policies, conflict-of-interest declarations and TLPT mission history through connectors to your HR systems (Workday LU, Sopra Steria HR Suite), your vendor repository (Odoo, Sage BOB 50) and offensive certification registries, then computes an eligibility score before any engagement letter.
- Automatically verifies the validity and expiry date of each red team member's certifications (CREST, OSCP, GIAC) and alerts 90 days before lapse.
- Detects conflicts of interest by cross-referencing access history, audit assignments and administered functions against the scope of the tested critical functions.
- Checks the presence and scope of the liability insurance policy covering offensive operations.
- Tracks consecutive TLPTs per internal tester and blocks any reassignment prohibited by Article T.3.
- Verifies the actual externality of the threat intelligence provider by analysing ownership links and group structures.
- Produces a timestamped PDF eligibility file, opposable to the CSSF and the BCL, demonstrating the independence required by the TIBER-LU framework.
Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual testers, with a free blank audit within 48h to measure your exposure before any commitment.
