The classic trap
The trap is not launching a TLPT, it is cutting corners on one phase. The CSSF (TLPT authority under Article 26 of DORA) and the BCL, within the TIBER-LU framework whose Implementation Document was revised on 20 June 2025, refuse to grant test recognition when the scope was not validated upfront, when threat intelligence scenarios lack credibility, or when the remediation plan stays purely declarative. An unrecognised TLPT carries no compliance value: the entity spent six months and a significant budget for zero regulatory coverage. Supervisors mainly sanction the broken traceability between the deliverables of the four phases.
The minimum deliverables you must never neglect per phase
- Preparation: scoping note, scope of critical functions in real production, formal CSSF validation, team composition (white team, control team) and exercise risk register.
- Threat intelligence: TI report documenting relevant threat actors, TTPs (MITRE ATT&CK) and credible attack scenarios targeting your critical functions.
- Red teaming: red team report detailing attacks executed over 10 to 12 weeks, compromise paths, flags reached and blue team reaction.
- Closure: summary report, dated and prioritised remediation plan, test recognition by the authority.
- Remediation must feed your ICT risk management under CSSF circular 20/750, and include your ICT providers in the tested scope (circulars 22/806 and 25/882, subcontracting RTS 2025/532).
The recurring weak point: the remediation phase ends with a PDF that goes dormant, with no enforceable tracking of critical findings. That is exactly what the CSSF checks when reviewing the execution of DORA art. 26-27.
How Luxgap automates this risk
Our Luxgap TLPT Phase Conductor turns the preparation, threat intelligence, red teaming and closure sequence into a traced chain of deliverables that is enforceable before the CSSF, leaving no report orphaned. The tool orchestrates the four phases of RTS 2025/1190 by cross-referencing your critical functions register, your ICT provider contracts (Odoo, eBRC, LuxConnect) and your defence telemetry (Microsoft Defender, Azure Sentinel, CrowdStrike) to continuously verify that each phase produces the deliverable with the required minimum content.
- Automatically verifies that the scoping note, scope and CSSF validation are present before allowing the move to the TI phase, in line with the TIBER-LU framework.
- Maps the threat intelligence report scenarios onto MITRE ATT&CK and alerts when a scenario targets no critical function in real production.
- Tracks red team execution across the 10 to 12 weeks, timestamps each flag reached and correlates it with blue team detection from Sentinel and CrowdStrike.
- Turns each red team finding into a dated, prioritised remediation ticket injected into your ICT risk management under CSSF circular 20/750.
- Includes the ICT providers in scope (circulars 22/806 and 25/882, RTS 2025/532) and alerts when a critical subcontractor is excluded from the test without justification.
- Produces a timestamped and sealed PDF summary file, enforceable before the CSSF and the BCL to obtain test recognition.
Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure the maturity of your TLPT setup before any commitment.
