How to comply with recital 29 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 29 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThis procedural recital, often overlooked, hides strategic information: the TLPT RTS was calibrated after an explicit cost-benefit analysis and sector consultations. In practice, the CSSF and the BCL will not accept a financial entity invoking proportionality to avoid TLPT by arguing the test is too costly or disproportionate. The legislator has already settled that trade-off upstream: the burden is deemed proportionate to systemic risk. The classic mistake is to neglect the traceability of this proportionality reasoning in your own TIBER-LU file, when the authority expects a documented justification of the chosen scope.What this recital concretely changes for your TLPTA recital is not normative, but it clarifies intent and therefore the interpretation of Articles 26-27 of DORA and the RTS. Three operational consequences:The proportionality of the TLPT (three-year frequency, scope on critical functions in live production) results from an already validated cost-benefit trade-off: you must own it, not re-argue it with the CSSF.The scope of the test must cover real critical functions, including integrated ICT providers within the meaning of CSSF circulars 22/806 and 25/882 and outsourcing RTS 2025/532.The documentation of your scoping analysis becomes an opposable piece: it shows your local trade-off aligns with the European legislator's intent.Post-TLPT remediation directly feeds ICT risk management under CSSF circular 20/750: it is not an isolated deliverable.How Luxgap automates this riskOur Luxgap TLPT Scope Justifier turns your TIBER-LU scope note from a fragile declarative document into a proportionality file opposable to the CSSF and the BCL. The tool automatically maps your critical and important functions by cross-referencing your ICT outsourcing register (Article 30 DORA), your CMDB, Microsoft Defender and your Azure Sentinel flows, then links each scoping decision to the intent of RTS 2025/1190 and the TIBER-EU methodology revised on 11 February 2025.Automatically detects critical functions in live production to include in the red teaming by cross-referencing your CMDB and your DORA register of information.Classifies each ICT provider under CSSF circulars 22/806 and 25/882 and RTS 2025/532 to identify those to include in the test scope.Generates a timestamped scoping note that justifies each inclusion and exclusion against the cost-benefit trade-off adopted by the ESAs.Tracks the progress of remediation actions and feeds them back into your ICT risk management under CSSF circular 20/750.Produces a cryptographically sealed PDF file, opposable during a joint CSSF-BCL inspection, demonstrating the alignment of your TLPT with the TIBER-LU methodology.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure before any commi...

Recital 29

They trust us

Before we chat