How to comply with recital 10 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 10 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 10 clarifies a requirement that the CSSF (TLPT authority under Article 46 of DORA) and the BCL check concretely when validating the TIBER-LU scope specification document: the composition of the control team (the white team). The classic trap is appointing a control team lead without a real mandate, a mid-level IT manager who can neither arbitrate, nor access the management board, nor enforce secrecy over the test. Another common failure is an oversized white team, which multiplies leaks and compromises the confidentiality of the live test on critical functions in production. The recital reminds us that the safety of the TLPT relies first on the right human choice, not only on methodology.What the CSSF concretely expects from the control team leadA formal mandate to steer all aspects of the test (red team, blue team, threat intelligence, remediation) without needing intermediate authorisation.Direct access to the management board, required by the recital, to escalate any real incident occurring during the live test.Sufficient seniority and strategic positioning to enforce confidentiality, including towards uninformed management (the blue team is unaware of the test).A team that is as small as possible: each additional member is a compromise risk to document and justify.Deep knowledge of the entity, its critical functions and its ICT scope, including providers (CSSF circulars 22/806 and 25/882, subcontracting RTS 2025/532).Clear articulation with remediation, which then feeds ICT risk management (CSSF circular 20/750).These points are not normative in themselves, but they condition the acceptance of your TIBER-LU file by the BCL and the CSSF (DORA art. 26-27).How Luxgap automates this riskOur Luxgap Control Team Attestation makes it impossible to appoint a white team that fails recital 10: the tool builds and seals the TLPT governance file before launch. It cross-references your Active Directory, your M365 delegations of authority and your HR org chart (Sopra Steria HR Suite, Workday LU) to verify that the control team lead truly holds the mandate, seniority and escalation path to the management board required by the RTS.Automatically verifies that the control team lead holds a formal delegation covering red team, threat intelligence and remediation, with proof of management board access.Calculates a confidentiality index that alerts as soon as the control team size exceeds the minimum justifiable threshold, in line with the "as small as possible" principle.Maps critical functions and ICT providers in the test scope (CSSF circulars 22/806, 25/882, RTS 2025/532) to size the team to the strict minimum.Generates a timestamped nominative register of each member, with their role, access level and electronically signed confidentiality undertaking.Produces a sealed PDF file, enforceable before the CSSF and the BCL, aligning your TLPT governance with TIBER-LU and RTS 2025/1190.Traces the remediation loop into your ICT risk manage...

Recital 10

They trust us

Before we chat