How to comply with article 14 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article 14 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe attestation under Article 14 is the document that officially closes your TLPT and confirms, to the CSSF (TLPT authority under Article 46 of DORA) and the BCL within the TIBER-LU framework, that the test was conducted in line with the RTS. The trap: many financial entities treat the exercise as finished once the red team report is delivered, whereas the attestation can only be issued if the entire process, scoping, threat intelligence, execution and closure, meets the requirements of Annex VIII. An incomplete evidence file, a remediation plan not aligned with CSSF circular 20/750, or a non-timestamped chain of deliverables will prevent issuance of the attestation, and therefore block mutual recognition of the test across authorities.What Annex VIII requires in practiceProof that the tested critical or important functions genuinely cover the scope validated by the white team and the TLPT authority.Full traceability of the phases (preparation, threat intelligence, red teaming, closure) and of the actors involved (red team, blue team, white team, internal or external testers).Inclusion of critical ICT providers within the tested scope, in line with CSSF circulars 22/806 and 25/882 and the subcontracting RTS 2025/532.A documented remediation plan feeding into ICT risk management (CSSF circular 20/750) and an enforceable correction timeline.For cross-border tests involving several TLPT authorities, the designation of the lead authority that delivers the single attestation to the tested entities.How Luxgap automates this riskOur Luxgap TLPT Attestation Vault turns the end-of-test evidence scramble into an attestation file ready for the CSSF, sealed and opposable. The tool continuously aggregates TLPT deliverables from your test platforms (red team reports, Jira remediation tickets, Microsoft Defender and Azure Sentinel logs, CrowdStrike exports) and maps them automatically onto each Annex VIII requirement, without the white team having to rebuild the file by hand.Automatically collects every phase deliverable (scoping, threat intelligence, execution, closure) from your connected tools and cryptographically timestamps each item.Verifies in real time the coverage of the tested scope against the declared critical functions and alerts on any gap with the scope validated by the TLPT authority.Detects critical ICT providers missing from the scope against CSSF circulars 22/806 and 25/882 and RTS 2025/532.Generates the structured remediation plan that feeds directly into your ICT risk register (CSSF circular 20/750), with correction deadline tracking.Produces an Annex VIII compliant attestation file, cryptographically sealed and opposable, ready to present to the CSSF and the BCL, with handling of the multi-authority and lead authority scenario.Available as an add-on to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a...

Attestation

They trust us

Before we chat