How to comply with recital 18 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 18 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 18 clarifies a requirement that the CSSF, as TLPT authority under Article 46 of DORA, systematically checks during TIBER-LU scoping validation: the threat intelligence report cannot be generic. What authorities penalise in practice is not the absence of a test, but a shaky threat intelligence effort that never links the entity's real attack surfaces (the targets) to credible threat actors for its profile (the threats). A TI report that recycles a sector landscape without contextualising it to the critical or important functions running in production fails the validation phase, and both the BCL and CSSF send the provider back to the drawing board.The two areas of interest your TI report must coverRecital 18 requires the threat intelligence provider to cover at least two axes, otherwise the red team goes in blind. Here is how to structure the collection to survive review by the white team and test managers:Map the real attack surfaces (targets): exposed assets, ICT providers included in scope under CSSF circulars 22/806 and 25/882, privileged accounts, subcontracting chains qualified via RTS 2025/532.Identify the relevant threat actors (threats) and probable scenarios, aligned with the financial entity's profile rather than a theoretical catalogue.Incorporate, where available, the national threat landscape provided by the TIFM authority as a baseline, without stopping there.Organise feedback on the draft report from testers, the control team and test managers before the scope is frozen.Respect the indicative duration of roughly four weeks for the collection process from the TIBER-EU framework, revised by the ECB on 11 February 2025.Feed remediation and ICT risk management under circular 20/750, tracing each scenario to its corrective plan.How Luxgap automates this riskOur Luxgap Threat Landscape Synthesizer turns the chore of intelligence collection into a contextualised, opposable threat dossier aligned with TIBER-LU. A specialised LLM agent continuously cross-references your exposed asset inventory (Microsoft Defender External Attack Surface Management, Azure Sentinel, CrowdStrike), your ICT provider register built from CSSF circulars 22/806 and 25/882, and public threat intelligence feeds to materialise the target/threat link the CSSF requires, without asking the white team to compile a single PDF by hand.Scans your real external attack surface and reconciles it with the critical or important functions declared in your TLPT scope.Classifies relevant threat actors by entity profile and generates probable scenarios mapped to MITRE ATT&CK, ready to feed the red team.Automatically integrates the national landscape provided by the TIFM authority as a baseline and flags gaps against your specific exposure.Orchestrates the feedback cycle on the draft report between testers, control team and test managers, with time-stamped version tracking.Produces a cryptographically sealed threat intelligence report, opposable to the CSSF a...

Recital 18

They trust us

Before we chat