How to comply with article 13 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article 13 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapTLPT does not end with the red team report: Article 13 requires a structured remediation plan within 8 weeks, sent to the TLPT authority (in Luxembourg the CSSF, supported by the BCL through TIBER-LU) and, where different, to your competent authority. What gets sanctioned in practice is not having weaknesses, it is delivering an incomplete plan: findings listed without a root cause analysis, without prioritisation, without a completion date, or without a named owner. The CSSF reads this plan as evidence that remediation genuinely feeds your ICT risk management under circular 20/750, and a cosmetic plan undermines the whole DORA exercise (art. 26-27).The 5 mandatory blocks per findingFor each finding from the TLPT, your plan must contain, or risk being deemed non compliant:A description of the shortcoming, factual and tied to the tested threat scenario.A description of the remediation measures, with prioritisation and expected completion, including improvements to identification, protection, detection and response capabilities.A root cause analysis, not a surface level fix.The staff or function responsible for implementation, explicitly named.The residual risks of not implementing the measure and, where relevant, the risks induced by the measure itself.Mind the scope: under DORA (subcontracting RTS 2025/532, CSSF circulars 22/806 and 25/882), ICT providers included in the test fall within the remediation plan. A fix that depends on an external vendor must appear with its own owner and its own residual risk.How Luxgap automates this riskOur Luxgap Remediation Orchestrator turns the raw red team report into an Article 13 compliant remediation plan, ready to submit to the CSSF within the 8 week deadline, without your blue team retyping every finding. The tool ingests findings from your testing and SOC stack (Microsoft Defender, Azure Sentinel, CrowdStrike, Wazuh) and maps them automatically to the five blocks required by the text.Structures each finding with its five mandatory fields (shortcoming, measure, root cause, owner, residual risk) and blocks plan closure while a field is missing.Generates the root cause analysis with an LLM agent that correlates the weakness to the actual configurations pulled from Active Directory, M365 and your Sentinel feeds.Prioritises measures and computes realistic completion dates from the historical workload of your ICT teams.Automatically flags findings involving an in scope ICT provider (RTS 2025/532, circulars 22/806 and 25/882) and attaches the vendor owner.Continuously feeds your ICT risk register (circular 20/750) whenever a measure changes status, with no double entry.Produces a timestamped and sealed PDF plan, enforceable before the CSSF and the BCL, aligned with TIBER-LU (Implementation Document revised on 20 June 2025).Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will run a demonstration on...

Remediation plan

They trust us

Before we chat