How to comply with recital 13 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 13 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 13 is an emergency exit, not a blank cheque. In practice, the CSSF (TLPT authority under Article 46 of DORA) and the BCL penalise financial entities that invoke the unavailability of a threat intelligence provider without documented evidence, or that engage a provider not fully meeting the comprehensive criteria without corresponding mitigation measures. The typical mistake is to treat this exception as a permanent sourcing shortcut, whereas RTS 2025/1190 requires a case-by-case demonstration and a prior assessment of all criteria by the TLPT authority.How to document the exception without getting caughtBuild an unavailability evidence file: unsuccessful tenders, documented refusals, conflict-of-interest or market-capacity constraints at the date of the test.Precisely map which RTS criteria the selected provider does NOT meet (years of experience, sector references, certifications, independence).Define mitigation measures proportionate to the residual risk: reinforced white team oversight, cross-review of threat intelligence deliverables, contractual framing of ICT subcontractors (CSSF circulars 22/806 and 25/882, subcontracting RTS 2025/532).Submit the whole package to the TLPT authority BEFORE launching the test, not after, since assessing the criteria is its responsibility.Record the decision in the ICT risk governance (CSSF circular 20/750) so the subsequent remediation integrates this residual risk.Remember the legislator's logic: the exception is tolerable but auditable. Without a timestamped proof of unavailability and formalised mitigation, the entity remains solely responsible for the quality of the TLPT before the CSSF.How Luxgap automates this riskOur Luxgap TLPT Provider Justifier turns the Recital 13 exception into an auditable evidence file, ready for the TLPT authority's assessment. The tool continuously scans the market of threat intelligence and red team providers, cross-references their certifications, references and availability against the comprehensive criteria of RTS 2025/1190, and automatically generates the search trail that proves the invoked unavailability.Detects and timestamps every provider solicitation (tender, refusal, conflict of interest) to materialise the unavailability evidence required by Recital 13.Classifies each candidate provider against the RTS criteria and highlights exactly which criteria are unmet, criterion by criterion.Generates a mitigation plan proportionate to the residual risk, aligned with TIBER-LU (Implementation Document revised on 20 June 2025) and CSSF circulars 22/806, 25/882.Produces the justification file ready to submit to the CSSF and the BCL before test launch, with a pre-filled assessment of the criteria.Feeds the ICT risk governance (circular 20/750) by injecting the residual risk into the remediation register.Produces a timestamped and sealed PDF report, opposable during a TLPT authority inspection.Available as a complement to a Luxgap DPO or CISO mandate ...

Recital 13

They trust us

Before we chat