EU frameworkGDPRNIS 2DORAAI ActWhistleblowing
CSSF circularsCSSF 26/906CSSF 25/892CSSF 25/893CSSF 26/915CSSF 20/758CSSF 18/698CSSF 22/806CSSF 25/883CSSF 25/880CSSF 25/881CSSF 25/882CSSF 20/750CSSF 12/552CSSF 11/504 (repealed)CSSF 24/847
Article 7

Selection of TLPT providers

Commission Delegated Regulation (EU) 2025/1190 on threat-led penetration testing (TLPT) under DORA · UE 2025/1190

Selection of TLPT providers

1.   The control team shall take measures to manage the risks relating to the TLPT and shall in particular ensure that, for each TLPT:

(a)

the threat intelligence provider and external testers provide the control team with a detailed curriculum vitae and copies of certifications that, according to recognised market standards, are appropriate for the performance of their activities;

(b)

the threat intelligence provider and external tester are duly and fully covered by proper professional indemnity insurances including against risks of misconduct and negligence;

(c)

the threat intelligence provider provides at least three references from previous assignments in the context of penetration testing and red team testing;

(d)

the external testers provide at least five references from previous assignments related to penetration testing and red team testing;

(e)

the staff of the threat intelligence provider assigned to the TLPT:

(i)

is composed of at least a manager with at least 5 years’ experience in threat intelligence and at least one additional member with at least 2 years’ experience in threat intelligence;

(ii)

display a broad range and appropriate level of professional knowledge and skills, including:

(1)

intelligence gathering tactics, techniques and procedures;

(2)

geopolitical, technical and sectorial knowledge;

(3)

adequate communication skills to clearly present and report on the result of the engagement;

(iii)

has a combined participation in at least three previous assignments in threat intelligence in the context of penetration testing and red team testing;

(iv)

does not simultaneously perform any blue team tasks or other services that may present a conflict of interest with respect to the financial entity, ICT third-party service provider or an ICT intra-group service provider involved in TLPT to which they are assigned;

(v)

is separated from and not reporting to staff of the same TLPT provider providing external testers for the same TLPT;

(f)

for external testers, the red team assigned to the TLPT:

(i)

is composed of at least a manager, with at least 5 years of experience in penetration testing and red team testing as well as at least two additional testers, each with penetration testing and red team testing of at least 2 years;

(ii)

displays a broad range and appropriate level of professional knowledge and skills, including knowledge about the business of the financial entity, reconnaissance, risk management, exploit development, physical penetration, social engineering, vulnerability analysis, as well as adequate communication skills to clearly present and report on the result of the engagement;

(iii)

has a combined participation in at least five previous assignments related to penetration testing and red team testing;

(iv)

is not employed by, nor provides services to, a threat intelligence provider that simultaneously performs blue team tasks for either a financial entity, an ICT third-party service provider, or an ICT intra-group service provider that is involved in the TLPT;

(v)

is separated from any staff of the same TLPT provider that simultaneously provides threat-intelligence services for the same TLPT;

(g)

the testers and the threat intelligence provider carry out restoration procedures at the end of testing, including secure deletion of information related to passwords, credentials, and other secret keys compromised during the TLPT, secure communication to the financial entities of the accounts compromised, secure collection, storage, management, and disposal of other data collected during testing;

(h)

testers, in addition to the restoration procedures at the end of testing as referred to in point (g), carry out the following restoration procedures:

(i)

command and control deactivation;

(ii)

scope and date kill switches;

(iii)

removal of backdoors and other malware;

(iv)

potential breach notification;

(v)

procedures for future back-up restoration which may concern malware or tools installed during the test;

(vi)

monitoring of the blue team activities and informing the control team of any possible detections;

(i)

testers and the threat intelligence provider do not perform, or participate in, any of the following activities:

(i)

unauthorised destruction of equipment of the financial entity and of its ICT third-party service providers, if any;

(ii)

uncontrolled modification of information and ICT assets of the financial entity and of its ICT third-party service providers, if any;

(iii)

intentionally compromising the continuity of critical or important functions of the financial entity;

(iv)

unauthorised inclusion of out-of-scope systems;

(v)

unauthorised disclosure of test results.

2.   The control team shall keep record of the documentation provided by the testers and the threat intelligence providers to evidence compliance with paragraph 1, points (a) to (f).

In exceptional circumstances, financial entities may contract external testers and threat intelligence providers that do not meet one or more of the requirements set out in paragraph 1, points (a) to (f), provided that those financial entities adopt measures that are appropriate to mitigate the risks relating to the lack of compliance with such points and record those measures.

Luxembourg specificity
cadre TIBER-LU (BCL et CSSF), Implementation Document revise le 20 juin 2025

In Luxembourg, TLPT is implemented through the TIBER-LU framework jointly operated by the BCL and the CSSF, whose Implementation Document was revised on 20 June 2025. Provider selection must meet, in addition to Article 7 of RTS 2025/1190, the TIBER-LU requirements and the interaction with CSSF circulars 22/806 and 25/882 (ICT providers in scope) and circular 20/750 (remediation feeds ICT risk management).

Luxgap practice: build your selection file in the format expected by the TIBER-LU team (BCL and CSSF) before engaging the provider, and keep the trail of CVs, certifications, insurances and references to respond to an inspection without delay.