Resiplan SaaS

TLPT: Threat-Led Penetration Testing

Digital Operational Resilience Testing under DORA

Complete guide to the TIBER-EU framework

Regulatory framework: DORA, Regulation (EU) 2022/2554, Articles 26 and 27, supplemented by Commission Delegated Regulation (EU) 2025/1190, the RTS on TLPT (in force since 8 July 2025)

Reference framework: TIBER-EU (Threat Intelligence-Based Ethical Red-Teaming)

Developed by: European Central Bank (ECB)

Mandatory frequency: Minimum every 3 years

Application: Financial entities identified by their competent authority (DORA Art. 26(8), third subparagraph)

What is TLPT?

Definition

Threat-Led Penetration Testing (TLPT) is an advanced cybersecurity test that simulates real attacks conducted by sophisticated malicious actors (APT - Advanced Persistent Threats).

Objective: Assess the financial entity's ability to detect, respond to and recover from a targeted and sophisticated cyberattack.

TLPT vs. Traditional Security Tests

Aspect Traditional Pentest TLPT / TIBER-EU
Objective Find technical vulnerabilities Test resilience against targeted real-world attacks
Approach Standardized test checklist Scenarios based on real threat intelligence
Scope Technical (IT/network/apps) Holistic (IT + personnel + physical + processes)
Duration Set by contract Active red team phase of at least 12 weeks, inside deadlines counted from the TLPT authority notification (RTS 2025/1190, Art. 9 and 11(5))
Teams Pentesters Red Team (attackers) + Blue Team (defenders) + White Team (arbiters)
Intelligence General vulnerability knowledge Threat Intelligence specific to financial sector
Detection Declared tests, Blue Team informed Blue Team not informed, "blind" test
Authority involvement None required TLPT authority validates the initiation information, scope, threat intelligence and red team plan, then issues an attestation (DORA Art. 26(7))

Who is Concerned by TLPT?

⚠ TLPT IS NOT MANDATORY FOR ALL ENTITIES

Only financial entities identified by their competent authority must carry out TLPT, at least every 3 years (DORA Art. 26(1)). The authority may ask for a higher or lower frequency based on the entity's risk profile. Microenterprises and entities under the simplified framework of Art. 16(1) are excluded.

Identification Criteria (RTS 2025/1190, Art. 2)

The competent authority weighs impact, financial stability concerns and ICT risk profile (DORA Art. 26(8), third subparagraph). RTS 2025/1190, Art. 2(2), then lists the entities the TLPT authority shall require to perform TLPT, unless its assessment shows that TLPT is not justified. There is no total-assets threshold.

Category Condition in RTS Art. 2(2)
Credit institutions Identified as G-SII or O-SII, or part of a G-SII or O-SII
Payment institutions More than EUR 150 billion of payment transactions in each of the 2 preceding calendar years
Electronic money institutions More than EUR 150 billion of payment transactions or EUR 40 billion of outstanding electronic money, in each of the 2 preceding calendar years
Central securities depositories, central counterparties All
Trading venues with an electronic trading system Highest national market share, or more than 5 % of Union turnover, in specified instruments in each of the 2 preceding calendar years
Insurance and reinsurance undertakings Two-step test on gross written premium, technical provisions and share of national total assets

Other Financial Entities

For others: TLPT is not legally mandatory. The testing programme of Articles 24 and 25 still applies, including tests at least yearly on all ICT systems and applications supporting critical or important functions (Art. 24(6)).

The TIBER-EU Framework

TIBER-EU is the framework developed by the ECB for threat intelligence-based ethical red teaming. RTS 2025/1190 was drafted in accordance with it and mirrors its methodology, process and structure; entities may apply TIBER-EU or a national implementation in as much as it is consistent with DORA Art. 26-27 and the RTS (recital 1).

Advantages of TIBER-EU:

The 8 Steps of a TLPT

RTS 2025/1190 organises a TLPT into a preparation phase (Art. 9), a testing phase covering threat intelligence (Art. 10) and the red team test (Art. 11), and a closure phase (Art. 12), followed by remediation (Art. 13) and attestation (Art. 14). The eight steps below break those phases down. Where the RTS sets a deadline, it is cited; where it sets none, we give none.

Phase 1: Preparation (initiation information within 3 months of notification, Art. 9(2))

Responsible: Financial entity + TLPT authority

Actions:

Phase 2: Provider Selection (Art. 7 and 9(4))

Responsible: Financial entity

Actions:

Minimum teams (RTS Art. 7(1)(e)-(f)):

  • Threat intelligence: a manager with at least 5 years of experience and at least one member with at least 2 years
  • Red team: a manager with at least 5 years of experience and at least two testers with at least 2 years each
  • Threat intelligence and red team staff of the same provider kept separate

Phase 3: Scoping (scope specification document within 6 months of notification, Art. 9(6))

Responsible: White Team + External Providers

Actions:

Phase 4: Threat Intelligence (typically about 4 weeks, RTS recital 18)

Responsible: Threat Intelligence Provider

Actions:

Example Threat Intelligence Scenario:

Scenario: APT group "FIN7" (sophisticated cybercriminal)
Objective: Customer data theft and fraudulent transfers
Initial vector: Spear-phishing targeting finance employees
Tools: Custom malware + RDP exploitation
TTPs: Lateral movement via Active Directory, privilege escalation, exfiltration via encrypted channels

Phase 5: Red Team Test Plan (approved by the control team and the TLPT authority, Art. 11(1)-(3))

Responsible: Red Team

Actions:

Phase 6: Red Team Test (at least 12 weeks, Art. 11(5))

Responsible: Red Team (attack) vs. Blue Team (defense)

⚠ CRITICAL PHASE - "Blind" test

Red Team Actions:

Blue Team Role (SOC/CERT):

The Blue Team does NOT know a test is ongoing! They must react as to a real incident.

White Team Role (Arbiters):

Phase 7: Closure (red team test report within 4 weeks, Art. 12(2))

Responsible: White Team + Red Team + Blue Team

Actions:

Phase 8: Reporting, Replay and Remediation (Art. 12(4)-(7) and 13)

Responsible: White Team + External Providers

Actions:

Metrics and Evaluation

Success/Failure Criteria

This grid is our internal reading aid. Neither DORA nor RTS 2025/1190 sets detection or response thresholds for a TLPT.

Aspect Evaluated Good (✓) Medium (⚠) Weak (✗)
Detection time < 24 hours 24h - 7 days > 7 days
Detection rate > 80% of actions 50-80% < 50%
Response time < 4 hours 4h - 24h > 24 hours
Containment effectiveness Attack stopped before critical systems Attack slowed but not stopped Full access achieved
Crisis communication Management informed quickly, DORA process activated Delays in escalation Failed communication
Recovery Critical services restored in <RTO Recovery >RTO Unable to recover

What is Really Being Tested

TLPT does NOT only test technology, but:

⏰ Timeline and Frequency

⏰ DORA Obligation: TLPT minimum every 3 years

There is no EU-wide date for a first TLPT. The test starts on notification from the TLPT authority (RTS 2025/1190, Art. 9(1)), then recurs at least every 3 years (DORA Art. 26(1)). The date of 17 January 2028, often quoted as a TLPT deadline, is the Commission review of DORA (Art. 58(1)).

The RTS Clock, From Notification to Remediation Plans

Step Deadline or minimum Source
Notification from the TLPT authority Starts the clock Art. 9(1)
Initiation information (project charter, control team lead, testers) Within 3 months of notification Art. 9(2)
Scope specification document, approved by the management body Within 6 months of notification Art. 9(6)
Threat intelligence Typically about 4 weeks (not a legal deadline) Recital 18
Active red team testing phase At least 12 weeks Art. 11(5)
Red team test report Within 4 weeks after the active phase Art. 12(2)
Blue team test report, replay and purple teaming No later than 10 weeks after the active phase Art. 12(4)-(5)
Summary report of findings Within 8 weeks of the authority notification that both reports are complete Art. 12(7)
Remediation plans Within 8 weeks of that same notification Art. 13(1)
Attestation Issued by the TLPT authority DORA Art. 26(7); RTS Art. 14

Recommendation: Validations by the TLPT authority have no deadline in the text, so no total duration can be read from the RTS. What the text does make clear is that the preparation phase is short. Prepare the inventory of critical or important functions, the provider shortlist and the contractual participation of ICT third-party service providers (DORA Art. 26(3), 30(3)(d)) before the notification.

TLPT Budgeting

Expense Item What the RTS fixes What drives the cost
Threat Intelligence Provider Manager with at least 5 years plus one member with at least 2 years; 3 references (Art. 7(1)(c), (e)) Critical or important functions in scope, number of scenarios
Red Team Provider Manager with at least 5 years plus two testers with at least 2 years; 5 references (Art. 7(1)(d), (f)); active phase of at least 12 weeks (Art. 11(5)) Scope, scenarios (at least three, Art. 10(3)), ICT third-party providers involved
Internal control team Control team lead and team (Art. 9(4)); replay and purple teaming (Art. 12(5)) Staff time over the full cycle
Post-test remediation Remediation plan for every finding (Art. 13) The findings; often the largest and least predictable line

DORA and RTS 2025/1190 set no cost figures, and we do not publish price ranges we cannot source. Ask providers to quote against the requirements above.

Cost influencing factors:

✓ TLPT Preparation Checklist

Before the Notification

Within 3 to 6 Months of the Notification (Art. 9(2) and 9(6))

Threat Intelligence and Red Team Plan (Art. 10 and 11(1)-(3))

Active Red Team Test (at least 12 weeks, Art. 11(5))

Closure and Reporting (Art. 12 and 13)

⚠ Common Errors to Avoid

✗ Top 5 Fatal Errors

  1. Informing the Blue Team in advance

    → The test loses all its value if defenders know they are being tested. Only the White Team (3-5 people max) should be aware.

  2. Too limited scope

    → Excluding systems out of fear creates blind spots. A real attacker will exclude nothing.

  3. Stopping the test too early

    → Letting the Red Team go all the way (within RoE limits) reveals the true level of resilience.

  4. Not preparing the remediation plan

    → Identifying flaws is useless if no budget/timeline for correction is planned.

  5. Considering the test as "a checkbox"

    → TLPT is an immense learning opportunity. Organizations that benefit most are those that integrate it into a continuous improvement approach.

Resources and References

Need Help Implementing These Requirements?

Our experts can guide your institution through DORA compliance, from gap analysis to full implementation.

Free Gap Analysis Consulting Services Download All Guides

Practitioner tools for DORA compliance teams

Workbooks, playbooks and certifications built for EU financial entities. Add several to your cart: volume discounts apply automatically.

academy-bundle

DORA Certifications Bundle

399 € excl. VAT
academy

DORA for IT & Security Teams

199 € excl. VAT
academy

DORA for ICT Providers & Vendors

199 € excl. VAT
278
certificates issued
198
certified professionals
22
programmes awarded

Browse the full library · Excel toolkits · Certifications

How Compliant Is Your Institution?

Take our free 5-minute assessment and get an instant DORA compliance score with personalised recommendations.

Get Your Free DORA Score Join the Webinar Waiting List