How to comply with article 17 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article 17 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 17 sets the entry into force of the RTS, but the real trap lies elsewhere: many financial entities treat this as a distant deadline, when the RTS has applied since 8 July 2025. The CSSF, as the TLPT authority under Article 26 of DORA, and the BCL under the TIBER-LU framework (whose Implementation Document was revised on 20 June 2025) sanction lack of preparation: significant entities with no test plan, critical function scope left uncharted, or ICT providers excluded from the scope when they should be included. A delayed rollout is never an acceptable excuse once the application date has passed.What entry into force actually triggersAn entry into force date is not a mere calendar marker: it activates a chain of obligations whose inertia is costly during an inspection. Points to verify immediately:Confirm whether your entity is designated as significant and therefore subject to TLPT under Article 26 of DORA.Map the critical or important functions tested in live production, not in a staging environment.Include ICT providers in the test scope, in line with the outsourcing RTS 2025/532 and CSSF circulars 22/806 and 25/882.Structure the red team, blue team, white team and threat intelligence streams according to the TIBER-EU methodology revised on 11 February 2025.Plan the remediation phase that feeds ICT risk management under CSSF circular 20/750.Document the full cycle to demonstrate compliance with Articles 26 and 27 of DORA if the CSSF or BCL requests it.How Luxgap automates this riskOur Luxgap TLPT Readiness Tracker turns the entry into force date into an opposable roadmap and makes it impossible to miss a TIBER-LU milestone. The tool connects to your CMDB, Microsoft Defender, Azure Sentinel, CrowdStrike and your ICT provider register to automatically reconstruct the real scope of critical functions to be tested, without asking your CISO to fill in a spreadsheet.Calculates your TLPT applicability status by cross-referencing your prudential data against the criteria of Article 26 of DORA and the BCL/CSSF TIBER-LU framework.Maps critical or important functions in live production and links them to relevant ICT providers via the 2025/532 register.Tracks each cycle milestone (scoping, threat intelligence, red teaming, remediation) with instant Teams alerts as a deadline approaches.Verifies that CSSF circulars 22/806, 25/882 and 20/750 are covered by your deliverables, and flags undocumented gaps.Generates a timestamped, sealed PDF report, opposable to the CSSF and the BCL, demonstrating compliance with Articles 26 and 27 of DORA.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commitment.

Entry into force

They trust us

Before we chat