Published on 19 June 2025
TIBER-LU Implementation document
CSSF
The BCL and the CSSF are pleased to announce the release of the TIBER-LU Implementation Document, updated as of 20 June 2025.
Following the entry into force of the Digital Operational Resilience Act (DORA), in particular the Threat Led Penetration Testing (TLPT) requirements, and the publication of the revised TIBER-EU Framework by the ECB on 11 February 2025, the Banque centrale du Luxembourg (BCL) and the Commission de surveillance du secteur financier (CSSF) decided to revise the TIBER-LU framework for controlled cyber-attacks, which was implemented jointly on 3 November 2021. This revision marks an important step for the continuation of the TIBER-LU programme after the entry into force of DORA and its TLPT component.