DORA: resilience testing (TLPT) explained
DORA TLPT, threat-led penetration testing on live production systems, is mandatory only for the financial entities that their supervisor designates. In addition, almost every financial entity must test its critical systems every year. Here is what Articles 24 to 27 require, who has to carry out TLPT, how it runs and how to prepare.
In 30 seconds: DORA requires a testing programme with at least yearly tests of the systems that support critical or important functions. In addition, entities identified by their competent authority must carry out DORA TLPT at least every three years. It follows TIBER-EU and includes at least 12 weeks of red teaming and mandatory purple teaming. Then come a remediation plan and an attestation from the authority, recognised across the EU.
Legal framework and the general testing programme
Testing sits in Chapter IV of Regulation (EU) 2022/2554 (DORA), which has applied since 17 January 2025. If you want the big picture first, read DORA explained.
- Article 24: general requirements. A risk-based testing programme within the ICT risk-management framework. It also requires independent testers and remediation of every issue found.
- Article 25: the list of tests of ICT tools and systems.
- TLPT (Article 26): advanced, threat-led testing.
- Article 27: requirements for testers.
Article 25 mentions, among others, vulnerability assessments and scans, open source analyses and network security assessments. It also lists gap analyses, physical security reviews and source code reviews where feasible. Finally, it includes scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
Article 24(6) then sets the minimum frequency. Except for microenterprises, entities must test at least yearly the ICT systems and applications supporting critical or important functions.
DORA TLPT: who must do it and what Article 26 requires
DORA TLPT mimics the tactics of real attackers, identified through threat intelligence. It targets the live production systems behind an entity’s critical functions, without the defenders knowing.
Who has to do it
First, the requirement excludes microenterprises and entities under the simplified framework in Article 16. Among the rest, the competent authority identifies the entities that must test. To do so, it looks at their impact on the sector, financial stability concerns and their ICT risk profile.
In addition, the technical standards presume that G-SII and O-SII credit institutions must test, unless the assessment says otherwise. The same applies to payment and electronic money institutions above EUR 150 billion in payment transactions. That threshold applies to each of the two previous years. For e-money, the alternative threshold is EUR 40 billion of outstanding e-money. The presumption also covers central securities depositories, central counterparties and certain electronic trading venues. Finally, it includes the largest insurance and reinsurance undertakings. If you work in banking and fintech or insurance, check where you stand.
DORA TLPT frequency and scope
TLPT takes place at least every three years. However, the authority may ask for a higher or lower frequency depending on the risk profile. It covers several or all critical or important functions and runs on live production systems. The entity identifies the underlying systems, processes and technologies, including outsourced ones. Then the authority validates the scope.
ICT third-party providers and pooled testing
If an ICT provider is in scope, the entity secures its participation and keeps full responsibility. When that participation could harm the provider’s other customers, the parties can agree in writing on pooled testing. In that case, the provider contracts an external tester directly. The test, led by one designated entity, then counts as TLPT for every participant.
Report, attestation and mutual recognition
At the end, the entity gives the authority a summary of findings and the remediation plans. It also provides documentation showing that it met the requirements. Then the authority issues an attestation that allows mutual recognition of TLPT between Member States. However, the entity remains responsible for the impact of the test.
Tester requirements (Article 27)
- Highest suitability and reputability.
- Technical and organisational capabilities and expertise in threat intelligence, penetration testing and red team testing.
- Certification by an accreditation body in a Member State or adherence to formal codes of conduct or ethical frameworks.
- Independent assurance or an audit report on the management of the test’s risks and of confidential information.
- Professional indemnity insurance covering misconduct and negligence.
Entities may also use internal testers if the authority approves them. To do so, the authority verifies there are enough resources and no conflicts of interest. In addition, threat intelligence must come from an external provider. Entities using internal testers must contract external testers every three tests. However, credit institutions classified as significant under the Single Supervisory Mechanism may only use external testers. The technical standards also require the internal team to have a test lead and at least two more members. Moreover, they require 12 months of prior employment at the entity or its intra-group provider.
Technical standards, TIBER-EU 2025 and TIBER-ES
Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025 contains the operational detail. The Official Journal published it on 18 June 2025, and it has been in force since 8 July 2025. It specifies who must carry out DORA TLPT, the methodology for each phase and cooperation between authorities.
The Eurosystem updated TIBER-EU in February 2025 to align it with those standards. Specifically, it built in their deadlines, made purple teaming mandatory and renamed the “White Team” the “Control Team”. In Spain, the Banco de España (the Spanish central bank) adopted the framework as TIBER-ES and owns the framework. It works closely with the CNMV (the securities regulator) and the DGSFP (the insurance and pension funds supervisor). In addition, other jurisdictions that apply TIBER-EU recognise TIBER-ES tests.
DORA TLPT phases and deadlines
Delegated Regulation (EU) 2025/1190 sets these deadlines. However, overall duration depends on the scope and on the authority’s validations.
| Phase | What happens | Set deadline |
|---|---|---|
| Preparation | Initiation information, control team, provider selection and scope document approved by the management body | Initiation within 3 months and scope within 6 months of the authority’s notification |
| Threat intelligence | Threat analysis and selection of at least three scenarios; report approved by the authority | No specific deadline |
| Red team | Approved test plan, attacks on production, weekly reports | At least 12 weeks of active testing |
| Closure | Red team and blue team reports, joint replay of attacks and defences, purple teaming | Red team report within 4 weeks; blue team report and purple teaming within 10 weeks of the end of testing |
| Remediation and attestation | Summary report, remediation plans with root cause and owners, attestation | Summary and plans within 8 weeks of the authority confirming the reports are complete |
Teams and confidentiality
The control team (formerly the white team) manages the test inside the entity. Meanwhile, the red team attacks and the blue team defends without knowing about the test. In addition, only those who need to know receive information, and the test uses a code name. If a real incident occurs, the usual procedure applies, so see how to report a breach within 72 hours.
How to prepare for DORA TLPT: checklist
- First, map your critical or important functions and the systems, processes and providers that support them.
- Then run and document the yearly Article 25 tests before thinking about DORA TLPT.
- Define how you prioritise, classify and close findings and how you validate fixes.
- Review contracts with critical ICT providers: participation in testing, pooled testing and confidentiality.
- Identify who would sit on the control team and whether you would use internal or external testers.
- Finally, involve the management body: it approves the scope and is accountable for the remediation plan.
Your register of information on ICT third-party providers is the starting point for scoping. In fact, it already links providers, services and critical or important functions, exactly what DORA TLPT requires you to identify.
Frequently asked questions
Do all financial entities have to carry out DORA TLPT?
No. The general DORA testing programme applies to almost all of them, but TLPT only to those identified by their competent authority. The authority bases that decision on impact, systemic character and ICT risk profile.
What is the difference between a penetration test and TLPT?
A penetration test looks for vulnerabilities within a narrow technical scope known to the team. By contrast, TLPT starts from threat intelligence. It then attacks production for at least 12 weeks without the blue team knowing, and it also measures detection and response.
How often must you carry out TLPT?
At least every three years. However, the competent authority may increase or reduce that frequency based on the risk profile and operational circumstances.
Can you use internal testers?
Yes, with the authority’s approval and external threat intelligence, and by contracting external testers every three tests. However, significant credit institutions may only use external testers.
Does a TIBER-ES test count as DORA TLPT?
The Eurosystem updated TIBER-EU in 2025 to include the DORA TLPT steps and deliverables. TIBER-ES then applies it in Spain. Even so, what evidences compliance is the authority’s attestation.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with DORA testing and TLPT
Atalaya GRC plans your yearly DORA tests by system and critical function. It also records findings and remediation plans with owners and dates, and stores the evidence. In addition, the ICT third-party register provides the inventory for scoping, and the regulatory clock alerts you to deadlines. Finally, one control serves DORA, NIS2 and ISO 27001. See the DORA guide or request a demo.
