How to comply with recital 5 of TLPT RTS (EU 2025/1190)?

Question

I need to bring my Luxembourg organisation into compliance with recital 5 of TLPT RTS (EU 2025/1190) (UE 2025/1190). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapRecital 5 sets the human architecture of the TLPT: each actor (control team, blue team, testers, threat intelligence provider, CSSF cyber team) must exist formally and stay watertight from the others. The trap the CSSF and BCL observe in practice through the TIBER-LU framework: a control team (white team) that is too large and unintentionally tips off the blue team, destroying the validity of the test, because the defense is no longer tested blind. A TLPT whose role separation is not documented and traceable is downgraded to a mere exercise with no regulatory value under Article 26 of DORA.The 5 roles to segregate, and their trapsControl team (white team): small internal team (CISO, a few executives) that runs the test in secret. Trap: too broad a human scope that leaks toward the defense.Blue team: the real defense in production, which must NOT know a test is running. It is the party being evaluated.Testers (red team provider): external provider simulating the attacker. Must comply with the outsourcing RTS (EU) 2025/532 and CSSF circulars 22/806 and 25/882.Threat intelligence provider: supplies realistic threat scenarios, distinct from the testers.CSSF/BCL TLPT cyber team: validates the scope, the scope specification document and closure, under TIBER-LU (Implementation Document revised on 20 June 2025).The remediation that closes the test then feeds into ICT risk management under CSSF circular 20/750, rather than a report filed and forgotten.How Luxgap automates this riskOur Luxgap TLPT Role Orchestrator makes a leak between control team and blue team impossible by materializing, tracing and sealing the role separation of recital 5 throughout the test. The tool integrates with your Active Directory, Microsoft Entra ID, Azure Sentinel and ticketing tools to map who knows what, and to alert the moment test information crosses a segregation barrier.Automatically maps the five TIBER-LU roles (control, blue, testers, threat intelligence, CSSF/BCL cyber team) and assigns access segmented by Entra ID group.Detects in real time any communication or ticket that would expose the blue team to the existence of the test, with an instant Teams alert to the control team.Verifies that the red team provider meets the outsourcing requirements of RTS (EU) 2025/532 and CSSF circulars 22/806 and 25/882 (certifications, clauses, register).Generates the scope specification document and the prefilled role log, aligned with the TIBER-LU Implementation Document of 20 June 2025.Produces a timestamped, sealed PDF report, enforceable before the CSSF and BCL, demonstrating team watertightness and the validity of the TLPT under Article 26 of DORA.Traces post-test remediation and injects it into your ICT risk register in line with CSSF circular 20/750.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalized quote and our teams will prepare a demonstration on your real scope, with a free ...

Recital 5

They trust us

Before we chat