I need to bring my Luxembourg organisation into compliance with recital 61 of DORA (UE 2022/2554). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Recital 61 DORA — Recital 61 · official text + guide

EU frameworkGDPR NIS 2DORAAI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Recital 61

Digital Operational Resilience Act · UE 2022/2554

(61)

In order to take advantage of internal resources available at corporate level, this Regulation should allow the use of internal testers for the purposes of carrying out TLPT, provided there is supervisory approval, no conflicts of interest, and periodical alternation of the use of internal and external testers (every three tests), while also requiring the provider of the threat intelligence in the TLPT to always be external to the financial entity. The responsibility for conducting TLPT should remain fully with the financial entity. Attestations provided by authorities should be solely for the purpose of mutual recognition and should not preclude any follow-up action needed to address the ICT risk to which the financial entity is exposed, nor should they be seen as a supervisory endorsement of a financial entity’s ICT risk management and mitigation capabilities.

Luxembourg specificity

reglement CSSF 24-01 relatif a DORA et circulaire CSSF 22/806

In Luxembourg, the CSSF is the designated TLPT authority and applies the TIBER-LU framework (Threat Intelligence-Based Ethical Red Teaming), aligned with the ECB's TIBER-EU. CSSF Regulation 24-01 on DORA and CSSF Circular 22/806 on ICT outsourcing specify the approval conditions for internal testers: file submitted at least 6 months before test launch, independence charter countersigned by the Board, and notification of any team change during the test.

Luxgap practice: our consultants prepare your CSSF approval file in parallel with TIBER-LU scoping to avoid the typical 4-to-8 month gap between internal decision and supervisory green light.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Recital 61 opens a very tempting door: use your own red team to run TLPTs and save the cost of an external provider. But the CSSF sanctions in practice three recurring drifts on this point: failure to formally demonstrate the absence of conflicts of interest between internal testers and defense teams, oversight of the mandatory rotation every three tests, and confusion between an execution attestation and a supervisory endorsement of the ICT risk management framework. A TIBER-LU attestation never equals prudential approval.

The cumulative conditions for using internal testers

Prior and explicit CSSF approval, documented before the test starts, not retroactively.
Strict organisational separation between the internal red team and blue team / SOC / CISO functions: distinct reporting lines, budget isolation, no dual hats.
Mandatory rotation: out of three consecutive TLPTs, at least one must be conducted by an accredited external provider.
The threat intelligence provider must always be external to the financial entity, even when testers are internal: this is a hard separation rule, no exception.
Full responsibility for the test remains with the financial entity: no transfer to the internal tester, no dilution within the group.
The final attestation issued by the authority is a mutual recognition tool across Member States, nothing more: the CSSF retains full discretion to require subsequent corrective actions.

How Luxgap automates this risk

Our Luxgap TLPT Governance Orchestrator closes the main blind spot of recital 61: proving, file in hand, that your internal testers meet all the eligibility conditions at the moment the CSSF asks, not three weeks later. The tool connects to your Active Directory, your HRIS (Workday, Sopra HR, Cegid), your ITSM (ServiceNow, Jira) and your supplier contract register to automatically rebuild the conflict-of-interest map and the rotation history test by test.

Automatically detects any role overlap between internal red team members and blue team / SOC / incident response staff by cross-checking AD groups and HRIS org charts.
Computes in real time the internal/external rotation counter over the last three TLPTs and alerts 6 months before the next mandatory external test deadline.
Verifies that the designated threat intelligence provider is indeed external and traceable in your DORA TIC supplier register, with automatic contract reconciliation.
Generates the pre-formatted CSSF approval request file (independence charter, mandates, RACI matrix, conflict-free attestation) ready to submit.
Produces a timestamped, cryptographically sealed PDF report, enforceable during a CSSF inspection, demonstrating cumulative compliance with article 26(8) and recital 61.
Archives execution attestations separately from the ICT risk management posture to prevent any interpretive confusion with the CSSF.

Available as an add-on to a Luxgap CISO mandate or as a standalone SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your actual red team setup, with a free 48-hour blind audit to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Recital 61

They trust us

Before we chat