How to comply with recital 19 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 19 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 19 sheds light on a handover that is often rushed in practice: the transition from targeted threat intelligence to the red team testing phase. Many financial entities treat the targeted threat intelligence report as a closed deliverable, emailed to the red team without a structured briefing. The CSSF, the TLPT authority under Article 46 of DORA, and the BCL, within the TIBER-LU framework whose Implementation Document was revised on 20 June 2025, expect a documented handover where the threat intelligence provider gives detailed explanations of the report and an analysis of possible threat scenarios before the red team plan is finalised. Skipping this step undermines the realism of the test and therefore its validity under Article 26 of DORA.What this recital concretely requires of the test planA recital is not binding, but it sets the legislator's intent for interpreting the red team testing plan requirements. Concretely, this handover must be traced and tooled:Hold a documented debrief session where the threat intelligence provider presents the targeted report to the testers, not a mere PDF transfer.Produce a written analysis of possible threat scenarios, aligned with threat actors relevant to your critical functions in live production.Link each scenario to the scope specification document so the red team finalises a credible plan covering your ICT providers within the test scope.Keep evidence of this handover for review by the white team and by the TLPT authority (CSSF, BCL).Ensure critical ICT providers, covered under the subcontracting RTS 2025/532 and CSSF circulars 22/806 and 25/882, are addressed by the scenarios.How Luxgap automates this riskOur Luxgap Threat Scenario Bridge turns the intelligence to red team handover, often informal, into a transition file that stands up before the CSSF and the BCL. The tool ingests the targeted threat intelligence report and the scope specification document, then a specialised LLM agent maps each threat actor to your declared critical functions and to the ICT providers in your DORA register, materialising scenarios the red team can finalise without a wasted meeting.Classifies each threat scenario against the TIBER-EU framework revised on 11 February 2025 and the TIBER-LU framework of 20 June 2025.Cross-references the report's threat actors with your critical function mapping and your ICT provider register (CSSF circulars 22/806 and 25/882).Generates a handover session agenda and captures the detailed explanations from the threat intelligence provider, time-stamped.Detects uncovered scenarios or overlooked critical functions before the red team plan is finalised.Produces a time-stamped PDF transition file, enforceable before the TLPT authority, showing the red team phase rests on fully exploited intelligence.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration...

Recital 19

They trust us

Before we chat