How to comply with annex VIII of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with annex VIII of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe TLPT attestation is not a closing formality: it is the document that proves to the CSSF (TLPT authority under Article 46 of DORA) and the BCL that your test covered the right scope. The trap sanctioned in practice is the mismatch between the attestation and reality: critical or important functions declared in scope but not actually tested (point a.iii), an insufficient active red team testing phase relative to the TIBER-LU framework, or ICT third-party service providers missing even though they carry a critical function. Under DORA, remediation feeds ICT risk management (CSSF circular 20/750): a poorly documented attestation weakens the entire compliance chain and may lead the authority to refuse recognition of the test.The information your attestation must trace flawlesslyStart and end dates of the TLPT, and the duration in calendar days of the active red team testing phase (a.vii).Exhaustive list of critical or important functions in scope, with explicit justification for any function not tested (a.ii and a.iii).Other financial entities involved and ICT third-party service providers that participated, consistent with CSSF circulars 22/806 and 25/882 on ICT outsourcing (a.iv, a.v).Nature of testers: use of internal testers, possible application of Article 5(3), second subparagraph (a.vi).Other TLPT authorities involved and in which capacity, for cross-border tests (b).List of documents examined by the TLPT authority for the purposes of the attestation (c).Each of these lines must be traceable and documented: the authority does not rely on the declaration alone, it cross-checks the attestation against the test plan, the red team report and the remediation plan.How Luxgap automates this riskOur Luxgap Attestation Assembler turns the assembly of the TLPT attestation dossier into a structured, complete and CSSF-ready deliverable, with no last-minute manual reconstruction. The tool continuously aggregates the artefacts produced during the test (scoping document, threat intelligence, red team logs, remediation plan) and automatically verifies that every point of Annex VIII is covered before submission to the TLPT authority.Automatically reconstructs the scope of critical or important functions by cross-checking your ICT register (circular 20/750) with the TIBER-LU scoping document, and flags any function declared but not tested.Calculates the actual duration in calendar days of the active red team testing phase from timestamped logs and compares it with the minimum requirements of the TIBER-LU framework.Detects the ICT third-party service providers involved via your outsourcing register (circulars 22/806 and 25/882) and verifies their mention in the attestation.Generates the list of documents examined and an opposable index, with cryptographic timestamping of each item transmitted to the CSSF and the BCL.Produces a sealed PDF report, structured section by section according to Annex VIII, ready to be handed to the TLPT authority ...

Details of the attestation of the TLPT referred to in Article 26(7) of Regulation (EU) 2022/2554

They trust us

Before we chat