How to comply with annex V of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with annex V of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe red team test report is not a wrap-up deliverable to archive: it is the keystone that the CSSF (TLPT authority under Article 46 of DORA) and the BCL review to attest the test's validity under Article 26 of DORA. In practice, financial entities fail because their report documents the flags reached but neglects unsuccessful attack paths, root cause analysis, or the leg-ups granted. Without these elements, the authority cannot issue the attestation, and the remediation that must feed the ICT risk management framework (CSSF circular 20/750) is left without prioritisation.The 10 points your red team report must coverThe targeted critical or important functions and the associated ICT systems, processes and technologies, as identified in the test plan.A summary of each executed attack scenario.Flags reached AND not reached, without filtering out failures.Attack paths followed successfully and unsuccessfully.Tactics, techniques and procedures (TTPs) used, mapped to MITRE ATT&CK.Deviations from the red team test plan, if any.Leg-ups granted, with justification.Actions known to the blue team to reconstruct and mitigate the attack (blue team detection).A description of each vulnerability and finding, with its criticality.Root cause analysis and prioritised remediation recommendations.Reminder: the scope includes your ICT providers (CSSF circulars 22/806 and 25/882, subcontracting RTS 2025/532). A report that omits a critical provider embedded in the test is incomplete under Annex V.How Luxgap automates this riskOur Luxgap Red Team Report Composer turns the chore of post-test drafting into structured opposable evidence mapped exactly to the ten points of Annex V, ensuring no finding slips through the cracks. The tool ingests red team engagement logs (Cobalt Strike, MITRE ATT&CK Navigator), correlates blue team detection alerts from Microsoft Defender, Azure Sentinel and CrowdStrike, and automatically rebuilds the full attack/detection timeline for each scenario.Maps every executed tactic, technique and procedure onto the MITRE ATT&CK matrix and automatically separates successful from unsuccessful paths.Correlates in real time the flags reached with the critical or important functions declared in the test plan, and flags any undocumented deviation.Detects blue team actions in Sentinel and CrowdStrike to objectively reconstruct detection and containment timing, without relying on self-declaration.Generates root cause analysis per vulnerability and computes a criticality score aligned with your ICT risk management (CSSF circular 20/750).Produces a prioritised remediation plan, re-injectable into your risk register, with deadlines and owners.Publishes a timestamped, cryptographically sealed PDF report structured point by point according to Annex V, opposable to the CSSF and the BCL during TLPT validation.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and ou...

Content of the red team test report (Article 12(2))

They trust us

Before we chat