Laws › TLPT RTS (EU 2025/1190)
UE 2025/1190

Commission Delegated Regulation (EU) 2025/1190 on threat-led penetration testing (TLPT) under DORA

The DORA technical standards for threat-led penetration testing, implemented in Luxembourg via TIBER-LU under CSSF authority.

Official source : EUR-Lex CELEX:32025R1190 ↗

9articles
6with Luxgap guidance
24havg response time

Overview

Art. T.0
Overview: how DORA, RTS 2025/1190 and TIBER-LU fit together

Scope and identification

Art. T.1
Which financial entities are subject to TLPT

Definitions

Art. T.2
The key roles: red team, blue team, white team, threat intelligence

Testers

Art. T.3 Advice
Internal and external testers: conditions and independence

Scope

Art. T.4 Advice
Scope: critical functions and real production systems

Phases

Art. T.5 Advice
TLPT phases: preparation, threat intelligence, red teaming, closure

Remediation

Art. T.6 Advice
Closure, report and remediation: what the authority expects

Mutual recognition

Art. T.7 Advice
Mutual recognition and cross-border pooled testing

Luxembourg

Art. T.8 Advice
TIBER-LU and the CSSF role: the Luxembourg implementation

Need to comply with TLPT RTS (EU 2025/1190)?

Our DPO and CISO team supports over 80 Luxembourg organisations. Free diagnosis, quote within 48h.

Request a diagnosis →