I need to bring my Luxembourg organisation into compliance with recital 25 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 25 DORA — Recital 25 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 25

Digital Operational Resilience Act · UE 2022/2554

(25)

Digital operational resilience testing requirements have been developed in certain financial subsectors setting out frameworks that are not always fully aligned. This leads to a potential duplication of costs for cross-border financial entities and makes the mutual recognition of the results of digital operational resilience testing complex which, in turn, can fragment the internal market.

Luxembourg specificity

loi luxembourgeoise du 1er juin 2023 portant mise en oeuvre du reglement DORA et circulaire CSSF 24/847

In Luxembourg, the CSSF is the competent authority to supervise digital operational resilience tests for financial entities, including TLPT (Threat-Led Penetration Testing). The law of 1 June 2023 implementing the DORA regulation and CSSF circular 24/847 specify that tests performed under the TIBER-LU framework (Luxembourg transposition of TIBER-EU led by the BCL) are automatically recognised as meeting DORA article 26 requirements, avoiding duplication for systemic banks.

Luxgap practice: if your entity has already performed a TIBER-LU exercise in the last three years, we reuse it as the DORA baseline without redoing the test, and only fill the documentation gaps required by the CSSF.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 25 explains why DORA imposes a unified resilience testing framework (TLPT, scenarios, scope): before DORA, a cross-border Luxembourg bank faced CSSF tests, ECB TIBER-EU tests, AMF tests and BaFin tests with no mutual recognition. The CSSF uses this recital to reject arguments like 'we have already been tested elsewhere, so we will not redo it': it is the opposite, DORA enforces a common baseline and requires that your tests be mutualisable across authorities, not avoided.

What this recital concretely changes for your tests

Your pentests and red teams must now be documented in the DORA format (articles 24 to 27), not your historical internal methodology, otherwise the CSSF does not recognise them as valid.
Results must be exportable to other European authorities (ECB, ACPR, BaFin): a test performed in Luxembourg on your subsidiary must be reusable by the group without repeating the exercise.
Test providers (red team, threat intelligence) must meet article 27 criteria: independence, certification, TIBER-EU experience or equivalent.
Frequency (annual for basic tests, triennial for TLPT) becomes a uniform floor, ending divergences between subsectors.
The tested scope must cover critical or important functions (CIF), not just the IT assets you internally consider sensitive.

How Luxgap automates this risk

Our Luxgap Resilience Test Orchestrator turns your scattered resilience testing programme into a single repository recognised by the CSSF, the ECB and other European authorities, removing the duplicate tests historically imposed by each regulator. The tool ingests your existing pentest reports (Wavestone, NVISO, Excellium, Approach Cyber), your Defender and Qualys scans, your TIBER-LU exercises and automatically reformats them into the DORA articles 24 to 27 format required by the CSSF.

Maps your critical or important functions by cross-referencing your RoPA register, your ServiceNow CMDB and your Odoo supplier contracts to define the minimum testing scope.
Generates the multi-year test plan compliant with DORA, with the triennial TLPT and annual tests schedule, exportable to the CSSF portal.
Automatically assesses your red team providers against article 27 criteria (independence, CREST/OSCP certifications, TIBER-EU experience) before signature.
Produces a mutual recognition dossier, cryptographically sealed, transmissible to the ECB or any other group authority to avoid redoing a test already performed.
Detects gaps between the tested scope and the declared critical functions scope, and alerts before the CSSF inspection.

Available as part of a Luxgap CISO mandate or as a dedicated SaaS module depending on your regulatory perimeter. Request a tailored quote and our teams will prepare a demonstration on your existing test reports, with a free 48h blind audit to measure the gap between your current practices and the DORA standard before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 25

They trust us

Before we chat