How to comply with recital 17 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 17 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 17 clarifies Article 3 of the RTS on TLPT scoping. The trap: financial entities narrow the scope to the most visible or easiest-to-test systems, forgetting critical functions with high symbolic or political status. The CSSF, the TLPT authority under Article 46 of DORA, and the BCL within the TIBER-LU framework (Implementation Document revised on 20 June 2025) validate the scope upfront and reject an undersized scoping. A scope that is too narrow, excluding for instance a critical ICT provider within the meaning of CSSF circulars 22/806 and 25/882, makes the test unrepresentative and non-compliant.What recital 17 concretely requires for scopingThe legislator demands a multi-criteria selection, not a mere technical choice. Here is how to operationalise it:Assess each critical or important function by its economic importance and its symbolic or political status, at national and Union level.Include functions whose failure would have a systemic impact on the Luxembourg financial sector, not only on the entity itself.Bring critical ICT providers into scope, in line with the subcontracting RTS 2025/532 and CSSF circulars 22/806 and 25/882.Document the selection rationale to submit it to the control team and to the CSSF/BCL.Provide a detailed scoping package to the red teamers and threat intelligence provider not involved in defining the scope, to ensure a smooth transition to the threat intelligence phase.How Luxgap automates this riskOur Luxgap Critical Function Mapper turns TLPT scoping from a debatable declarative exercise into a multi-criteria mapping that stands up to the CSSF and the BCL. The tool continuously queries your CMDB, Active Directory, Microsoft Defender, Azure Sentinel and your ICT provider register to reconstruct the real chain of critical or important functions, then scores them against the economic and symbolic grid intended by recital 17, without asking the CISO to fill in a spreadsheet.Automatically detects critical or important functions by cross-referencing CMDB, application flows and dependencies on ICT providers identified under CSSF circulars 22/806 and 25/882.Calculates a dual criticality score (economic impact plus symbolic or political status) aligned with the TIBER-LU framework and Article 26 of DORA.Classifies each function by its impact perimeter (entity, national, Union) to justify its inclusion or exclusion from the test.Generates the detailed scoping package ready to hand over to red teamers and to the threat intelligence provider not involved in defining the scope.Produces a timestamped and sealed PDF report, enforceable before the CSSF and the BCL, demonstrating the multi-criteria rationale of the agreed scope.Alerts when a new critical ICT provider or a new flow changes the relevant perimeter, feeding ICT risk management within the meaning of circular 20/750.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored qu...

Recital 17

They trust us

Before we chat