How to comply with recital 20 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 20 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 20 sets a clear intent: the active red team testing phase must last at least 12 weeks. In practice, the CSSF (the TLPT authority under Article 46 of DORA) and the BCL, through the TIBER-LU framework, reject compressed schedules where red teams are rushed to conclude before all flags are reached. The recurring trap: a significant financial entity negotiates a schedule that is too short to limit cost or operational exposure, producing a partial test where not all attack phases are executed. A truncated TLPT is not a valid TLPT, and the remediation that follows (CSSF circular 20/750) then rests on an incomplete picture of the threat.The factors that size your 12-week windowRecital 20 does not mandate a fixed 12 weeks: it sets a floor and a calibration method. Each factor below extends the real active window to plan in your TLPT (Threat Intelligence based Ethical Red Teaming).The number of parties involved: more white team members, ICT providers and group entities means coordination consumes more calendar time.The TLPT scope: each critical function in live production added extends the surface to cover without lowering the floor.The internal resources actually available on the entity side (blue team, business referents, technical access).External requirements: change freeze windows, production constraints, system sensitivity.The availability of supporting information: each delay in delivery by the entity pushes the active phase back accordingly.The inclusion of ICT providers in scope (CSSF circulars 22/806 and 25/882, subcontracting RTS 2025/532), which often requires prior contractual authorisations that lengthen the schedule.How Luxgap automates this riskOur Luxgap TLPT Timeline Planner turns the abstract 12-week floor into a schedule defensible before the CSSF and the BCL, calibrated on your real factors. The tool pulls your scope from connected sources (critical functions register, ICT subcontracting register in RTS 2025/532 format, Odoo provider contracts, asset inventory from Microsoft Defender or Azure Sentinel) and models the active window by crossing each Recital 20 factor, without asking your white team to build a Gantt chart by hand.Calculates the minimum active red team phase duration from the number of parties, TLPT scope and declared internal resources, with the 12-week floor applied automatically.Detects ICT providers in scope via your subcontracting register and alerts on prior contractual authorisations to obtain (CSSF circulars 22/806 and 25/882).Generates a schedule aligned with the TIBER-LU Implementation Document revised on 20 June 2025, with red team, blue team, white team and threat intelligence milestones.Simulates the impact of an information delivery delay and instantly recalculates the active phase end date.Produces a timestamped planning file in PDF, opposable to the CSSF and the BCL, documenting the justification for each retained duration against Recital 20.Links flags reached automatically to t...

Recital 20

They trust us

Before we chat