How to comply with article 3 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with article 3 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapArticle 3 places the TLPT authority (in Luxembourg, the CSSF supported by the BCL under the TIBER-LU framework) and its cyber team at the heart of the test: a designated test manager oversees every phase and monitors and ensures that the requirements of the RTS are met. The trap for the financial entity is to treat this test manager as a passive observer. In practice, the CSSF participates in all phases (scoping, threat intelligence, red teaming, closure, remediation) and penalises entities that neglect coordination with the Threat-Led Cyber Team: late notifications, wrong contact details, phases launched without the test manager's sign-off. Sloppy preparation results in a TLPT deemed non-compliant, hence to be redone, with the cost and operational exposure that entails.The coordination points the CSSF actually monitorsThe Article 9(1) notification must correctly deliver the TCT contact details AND return your validated white team and points of contact.Each phase (scoping, threat intelligence, red teaming, closure) requires the test manager's participation: no phase may start without documented approval.The primary test manager and their alternate must be identified on the entity side: a single reachable person is an unacceptable single point of failure for a test on critical functions in live production.ICT providers within scope (CSSF circulars 22/806 and 25/882, subcontracting RTS 2025/532) must be covered by the coordination: their consent and white team belong in the file.Traceability of exchanges with the TCT is evidence of methodological compliance aligned with TIBER-EU (revised by the ECB on 11 February 2025) and TIBER-LU (Implementation Document of 20 June 2025).Final remediation must feed your ICT risk management (CSSF circular 20/750), under the test manager's supervision.How Luxgap automates this riskOur Luxgap TLPT Engagement Orchestrator turns coordination with the CSSF test manager into a timestamped, opposable thread where no phase starts without traced approval. The tool synchronises your white team, your ICT providers and the TCT in a single space connected to M365, Teams, Azure Sentinel and your ICT risk register, and rolls out the TIBER-LU sequence automatically, without your CISO having to manually reconstruct the trail of exchanges.Structures the five TLPT phases (scoping, threat intelligence, red teaming, closure, remediation) and blocks the move to the next phase until the test manager's sign-off is timestamped.Generates the Article 9(1) notification template prefilled with the TCT contact details and logs the entity-side acknowledgement.Detects single points of contact and alerts on Teams as soon as a test manager or alternate becomes unreachable, eliminating the single point of failure.Cross-checks the test scope against your ICT provider contracts (Odoo, register 25/882) and flags critical providers not covered by documented consent.Publishes a cryptographically sealed PDF report, opposable to the CSS...

TCT and TLPT Test Managers

They trust us

Before we chat