How to comply with article T.6 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article T.6 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe trap in Article T.6 is believing the TLPT ends with a spectacular red report. The CSSF, the TLPT authority under Article 46 of DORA, and the BCL through the TIBER-LU framework only issue the attestation of completion if the remediation plan is documented, prioritised, dated, and above all executed and re-tested. The entities that get caught are those producing a fine red team report, parking critical vulnerabilities in a backlog, and never demonstrating actual remediation. CSSF Circular 20/750 (as amended by 25/881) requires this remediation to genuinely feed the ICT risk management framework (DORA Art. 5 to 16): a plan asleep in a PDF is not remediation, it is documented evidence of inaction.The practical traps of the closure phaseMissing prioritisation: vulnerabilities are listed without criticality or deadline, making the plan unenforceable during a CSSF review.Remediation not re-tested: the flaw is declared fixed without independent technical verification, contrary to the spirit of the RTS.Disconnect from ICT risk: the plan lives in an isolated file, detached from the risk register required by DORA Art. 6 and Circular 20/750.ICT providers forgotten: flaws affecting a critical subcontractor (eBRC, LuxConnect, Azure) are not tracked, although CSSF Circulars 22/806 and 25/882 bring them into scope.Attestation requested too early: the entity asks for the attestation before critical actions are effectively closed, which the CSSF refuses.Deadlines missed silently: no alerting mechanism flags overdue corrective actions to the white team and the risk committee.How Luxgap automates this riskOur Luxgap Remediation Tracker turns your TLPT remediation plan into a living, re-tested register that is enforceable before the CSSF, and makes a forgotten critical vulnerability impossible. The tool ingests the red team report and the criticality grid, then continuously syncs with your ticketing system (Jira, ServiceNow), your EDR (Microsoft Defender, CrowdStrike) and your SIEM (Azure Sentinel, Wazuh) to verify that every fix is not just planned but technically applied and re-tested.Automatically imports vulnerabilities from the TLPT report and prioritises them by criticality and the critical functions in production affected.Tracks each corrective action with its deadline, owner and status, syncing with Jira and ServiceNow without double entry.Re-tests flaw closure through your Defender, CrowdStrike, Sentinel and Wazuh signals, and blocks closure until technical proof is present.Alerts the white team and the risk committee on Teams as soon as a critical action passes its deadline.Tracks vulnerabilities affecting your critical ICT providers (eBRC, LuxConnect, Azure) in line with CSSF Circulars 22/806 and 25/882.Injects remediation directly into your ICT risk register (DORA Art. 6, Circular 20/750) and generates a time-stamped closure file, enforceable before the CSSF to obtain the attestation of completion.Available as a complement to a Luxg...

Closure, report and remediation: what the authority expects

They trust us

Before we chat