TIBER-LU and the CSSF role: the Luxembourg implementation
Commission Delegated Regulation (EU) 2025/1190 on threat-led penetration testing (TLPT) under DORA · UE 2025/1190
In Luxembourg, TLPT is conducted within the TIBER-LU framework, jointly adopted by the Banque centrale du Luxembourg (BCL) and the CSSF in November 2021. The TIBER-LU Implementation Document was revised on 20 June 2025 to align with DORA and the ECB-revised TIBER-EU of 11 February 2025.
The CSSF is the TLPT authority within the meaning of Article 46 of DORA for entities under its supervision. It identifies in-scope entities, validates scopes, oversees tests and issues attestations. The dedicated contact is tiber@cssf.lu.
For a Luxembourg financial entity, the right reflex is two-step: am I identified as subject to TLPT? (RTS 2025/1190 criteria), then how do I organise a compliant TIBER-LU test? (BCL/CSSF framework). This is exactly where the fog still confuses many players.
In Luxembourg, the CSSF is the designated TLPT authority under Article 46 of DORA for entities under its supervision, and the BCL co-drives the framework through the TIBER-LU Implementation Document revised on 20 June 2025. The single contact point is tiber@cssf.lu. Any identified entity must notify its intention to start the cycle at least 6 months before kick-off, or risk having the test rejected and rescheduled.
Luxgap practice: before commissioning any Red Team Provider, have your Scope Specification Document validated by the CSSF in an informal pre-meeting, this is the key to avoid a scope rejection 4 months later and a cycle delay.