How to comply with recital 27 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 27 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 27 clarifies a point many financial entities read to their own advantage: assuming that adding a single external consultant to a mostly internal team is enough to tick the external testers box required every three tests by Article 26(8) of DORA. Wrong. The CSSF, the TLPT authority in Luxembourg, and the BCL under the TIBER-LU framework treat a mixed internal/external team as a test performed with internal testers. In practice, the three-year cycle counter only resets when the red team is fully external. Miscounting means falling outside the regulatory deadline at the next review.How to read this recital in practiceKeep a testing cycle register that clearly labels each TLPT as full external or mixed/internal, since only the former satisfies the triennial obligation.A test run by an internal red team supported by an external threat intelligence provider still counts as internal under Article 26(8): the qualification depends on the offensive testing team, not on support functions.Verify the independence and accreditation of external testers per the RTS annex and the TIBER-LU Implementation Document revised on 20 June 2025.Plan budget and sourcing early: an accredited external red team is contracted months ahead, including critical ICT providers in scope (CSSF circulars 22/806 and 25/882, subcontracting RTS 2025/532).Feed the ICT risk management process with remediation findings (CSSF circular 20/750).The legislator's intent is clear: guarantee a genuinely independent view at regular intervals. Rigorous cycle counting is therefore a compliance requirement, not a mere administrative formality.How Luxgap automates this riskOur Luxgap TLPT Cycle Tracker makes the triennial cycle miscount impossible: it automatically qualifies each test as full external or internal/mixed and calculates the regulatory deadline for your next fully external red team test. The tool cross-references your vendor contracts (Odoo, Sage BOB 50), your ICT provider register and tester accreditation attestations to reveal the true nature of each team, without the CISO having to interpret recital 27 alone.Classifies each TLPT by red team composition and applies the recital 27 rule (mixed team = internal test).Calculates and displays the Article 26(8) triennial cycle counter in real time, with a Teams alert as soon as a full external test becomes mandatory.Verifies external tester accreditation and independence against the criteria of RTS 2025/1190 and the TIBER-LU Implementation Document.Includes critical ICT providers in the test scope using your subcontracting register (RTS 2025/532, CSSF circulars 22/806 and 25/882).Generates a timestamped PDF report enforceable before the CSSF and BCL, evidencing compliance with the triennial rhythm and cycle traceability.Available as an add-on to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real testing history, ...

Recital 27

They trust us

Before we chat