How to comply with article T.8 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article T.8 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe trap is not failing the test, it is believing you are out of scope. Many Luxembourg financial entities wait passively for a notification, while the CSSF, as TLPT authority within the meaning of Article 46 of DORA, identifies in-scope entities under the RTS 2025/1190 criteria and validates scopes. An entity that has not self-assessed, has not contacted tiber@cssf.lu and does not align its test with the TIBER-LU Implementation Document revised on 20 June 2025 exposes itself to a non-compliant, therefore invalid, test and to an unfavourable signal on the maturity of its ICT risk management (CSSF circular 20/750).The TIBER-LU two-step reflex to documentCheck eligibility: am I a significant entity under the RTS 2025/1190 criteria (systemic importance, ICT risk profile, role in the financial sector)?Map the critical or important functions tested in live production, not in a pre-prod environment.Include ICT providers in the test scope, in line with CSSF circulars 22/806 and 25/882 and outsourcing RTS 2025/532.Set up the four teams: white team, red team, blue team and threat intelligence, with testers meeting DORA art. 26-27 requirements.Align methodology and phases with TIBER-EU revised by the ECB on 11 February 2025, implemented by the BCL and the CSSF.Plan the remediation and feed it into the ICT risk management register (CSSF circular 20/750).How Luxgap automates this riskOur Luxgap TLPT Scope Navigator clears the eligibility fog by answering the only question that matters before any dialogue with tiber@cssf.lu: am I in scope, and over which perimeter? The tool cross-references your entity records (CSSF status, size and criticality indicators), your critical-function mapping and your ICT provider register pulled from Microsoft Defender, Azure Sentinel, CrowdStrike and your Odoo contracts to materialise the real TLPT scope, with no manual form to fill in.Automatically assesses your TLPT eligibility against the RTS 2025/1190 criteria and produces a reasoned inclusion or exclusion verdict.Maps critical or important functions in live production and identifies the ICT providers to include in scope (CSSF circulars 22/806 and 25/882, RTS 2025/532).Generates the TIBER-LU scoping file aligned with the Implementation Document of 20 June 2025, with the white/red/blue team and threat intelligence structure pre-filled.Tracks the test lifecycle from initiation to remediation and feeds your ICT risk register (CSSF circular 20/750).Produces a timestamped, defensible PDF report demonstrating to the CSSF your self-assessment approach and the methodological compliance of your test.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blind audit within 48h to measure your exposure before any engagement.

TIBER-LU and the CSSF role: the Luxembourg implementation

They trust us

Before we chat