How to comply with annex II of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with annex II of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe scope specification document is the first deliverable that the CSSF and the BCL review under the TIBER-LU framework. What the authorities challenge in practice is not an overly broad scope, but an artificially narrowed one: a financial entity that excludes a critical or important function without solid justification, or that quietly forgets an ICT system outsourced to a third-party provider. Annex II imposes a reverse declarative logic: you must list all your critical or important functions, then justify every exclusion. An incomplete scope gets the scope specification document rejected by the BCL test team and delays the entire TLPT.The control points the BCL checks line by lineThe exhaustive list of critical or important functions, consistent with your DORA mapping (Art. 8) and your ICT third-party register (RTS 2025/532).For each excluded function: an opposable explanation, not a generic sentence. The CSSF cross-checks it against your criticality analysis.For each included function: the supporting ICT systems, their outsourcing status and the exact name of the third-party provider (aligned with CSSF circulars 22/806 and 25/882).The jurisdictions where each ICT system is operated, a sensitive point for multi-region cloud and non-EU transfers.The high-level description of the preliminary flags, each tied to a precise security aspect: confidentiality, integrity, authenticity or availability.Consistency with the expected remediation (CSSF circular 20/750): a flag must be traceable to a manageable ICT risk.The most frequent trap: an outsourced ICT system described in the contract but absent from the scope because no one cross-checked the third-party register against the critical function mapping. The subcontracting chain (DORA Art. 26-27) must be visible in the test scope.How Luxgap automates this riskOur Luxgap TLPT Scope Composer builds your scope specification document directly from your real systems, and makes it impossible to miss a critical or important function or an ICT provider. The tool cross-references your DORA mapping, your ICT third-party register (RTS 2025/532), your CMDB and your Microsoft Defender, Azure Sentinel and AWS tenants to reconstruct every supporting ICT system, its outsourcing status and its execution jurisdiction, without asking your CISO to fill in a spreadsheet.Automatically detects each critical or important function and links it to its supporting ICT systems by cross-referencing CMDB, Active Directory and Defender flows.Identifies outsourced systems and retrieves the exact third-party provider name from your RTS 2025/532 register, aligned with CSSF circulars 22/806 and 25/882.Maps the execution jurisdictions of each system (multi-region AWS, Azure, eBRC, LuxConnect) and flags sensitive non-EU transfers.Generates prefilled preliminary flags, each tied to the covered security aspect (confidentiality, integrity, authenticity, availability), ready for the red team.Alerts when a critical or importa...

Content of the scope specification document (Article 9(6))

They trust us

Before we chat