Last updated: 23 October 2026
Quick answer: DORA TLPT is the advanced, intelligence-led red team test that selected EU financial entities must run on live production systems at least every three years. It is governed by Articles 26 and 27 of DORA and Delegated Regulation (EU) 2025/1190, which sets the phases, a minimum 12-week active testing period, tester requirements and remediation deadlines.
Most financial entities under the Digital Operational Resilience Act run a basic testing programme: vulnerability scans, penetration tests, scenario exercises. A smaller group must go further and undergo threat-led penetration testing, where ethical hackers mimic real adversaries against the systems that support critical or important functions.
Since the technical standard on TLPT entered into force on 8 July 2025, TLPT authorities have had the full rulebook to notify in-scope entities and run tests. This guide explains who is caught, how a test runs from notification to attestation, what the timelines are, and how a CISO can prepare without disrupting the business.
What is DORA TLPT?
DORA TLPT is a controlled attack simulation, based on current threat intelligence about the entity, that tests people, processes and technology supporting critical or important functions on live production systems. Its purpose is to show how well the entity can detect, respond to and recover from a sophisticated attack.
The legal basis sits in the Digital Operational Resilience Act (Regulation (EU) 2022/2554). Article 24 requires a digital operational resilience testing programme for all in-scope financial entities, Article 25 lists the basic tests, and Article 26 requires advanced testing by means of TLPT for entities identified by their competent authority. Article 27 sets requirements for the testers.
The detail is in Commission Delegated Regulation (EU) 2025/1190, the regulatory technical standards (RTS) on TLPT. It was adopted on 13 February 2025 and entered into force on 8 July 2025. DORA itself has applied since 17 January 2025, as the EIOPA DORA overview notes.
How TLPT differs from a normal penetration test
| Aspect | Standard penetration test | DORA TLPT |
|---|---|---|
| Scope | Specific applications or networks | Critical or important functions end to end, including people and processes |
| Environment | Often test or staging | Live production systems |
| Basis | Known vulnerability classes | Targeted threat intelligence and realistic attack scenarios |
| Awareness | Defenders usually informed | Blue team not told; only a small control team knows |
| Duration | Days to a few weeks | At least 12 weeks of active red teaming |
| Supervision | Internal only | TLPT authority oversight, ending in an attestation |
Who must perform DORA TLPT?
TLPT applies only to financial entities that their TLPT authority identifies, using criteria in Article 2 of the RTS. Categories include systemically important banks, large payment and e-money institutions, central securities depositories, central counterparties, major trading venues and large insurers.
Article 2 of Delegated Regulation 2025/1190 lists these groups, subject to the authority’s assessment:
- Credit institutions designated as global or other systemically important institutions (G-SIIs or O-SIIs), or part of such groups.
- Payment institutions whose total value of payment transactions exceeded EUR 150 billion in each of the two preceding financial years.
- Electronic money institutions above the same EUR 150 billion transaction threshold, or with more than EUR 40 billion of electronic money outstanding.
- Central securities depositories and central counterparties.
- Trading venues with the highest national market share in certain instruments or more than 5% of Union-level turnover in specified asset classes.
- Insurance and reinsurance undertakings above size thresholds based on gross written premiums, technical provisions and total assets.
Authorities can also include or exclude entities based on their impact, systemic character and ICT risk profile. In practice, being above a threshold makes selection likely but not automatic, and being below one does not guarantee exclusion.
Common mistake: assuming TLPT is the same as the basic testing programme. Every DORA entity needs Article 24 and 25 testing. TLPT is an additional obligation that starts only when the authority notifies you.
How often is TLPT required under DORA?
At least every three years. Article 26 of DORA requires identified entities to carry out TLPT at least every three years, so a test cycle effectively never ends: remediation from one test feeds planning for the next.
Each test must cover several or all critical or important functions and be performed on live production systems. Where ICT third-party service providers support those functions, they must be included in scope, and pooled testing with other financial entities is possible under Article 26 where a direct test would affect the provider’s other customers or confidentiality.
What are the phases of a TLPT test?
A DORA TLPT runs through preparation, threat intelligence, red team testing, closure and remediation, followed by an attestation from the TLPT authority. The RTS sets deadlines for each hand-off.
Phase-by-phase timeline
| Phase | What happens | Key deadlines in the RTS |
|---|---|---|
| Preparation | Authority notifies entity; control team formed; scope set; providers procured | Initiation documents within 3 months of notification; scope specification within 6 months |
| Threat intelligence | External provider analyses threats and drafts attack scenarios | Threat intelligence report agreed before testing starts |
| Red team testing | Testers execute scenarios against live systems; weekly updates to control team | Active testing of at least 12 weeks |
| Closure | Blue team informed; reports exchanged; replay and purple teaming | Red team report within 4 weeks of test end; blue team report and purple teaming within 10 weeks |
| Remediation | Summary report and remediation plan submitted | Test summary report within 8 weeks; remediation plan within 8 weeks of summary report notification |
| Attestation | TLPT authority confirms the test met the requirements | Issued after closure, supporting mutual recognition |
In practice: the calendar from notification to attestation often runs well beyond a year. Budget and resource planning should start the day the notification arrives, not when the red team starts.
Who is involved
- TLPT authority and test managers: the authority designates a test manager and at least one alternate to oversee each test.
- Control team: a small group inside the entity, led by a control team lead, that manages the test and keeps it secret from defenders.
- Threat intelligence provider: always external to the financial entity under Article 27 of DORA.
- Red team testers: external, or internal under strict conditions.
- Blue team: the entity’s defenders, who are not told about the test until closure.
What are the requirements for TLPT testers?
Testers must be suitable, reputable and independent, with minimum experience and insurance. Internal testers are allowed only under conditions, external testers must be used every three tests, and significant credit institutions under the SSM must use external testers only.
Under Article 27 of DORA, entities may use internal testers only if the authority approves, conflicts of interest are managed, and the threat intelligence provider remains external. The RTS adds concrete criteria. For external red team providers, the test lead needs at least five years’ experience in penetration testing and red teaming, supported by at least two further testers with at least two years’ experience each, relevant previous assignments and professional indemnity insurance. Threat intelligence providers face similar experience requirements, and testers must be separated from threat intelligence staff.
Internal testing teams must have a policy covering competence, conflicts of interest and management responsibilities, a lead plus at least two members, and staff who have been employed by the entity for at least the preceding 12 months.
Want to track TLPT findings, remediation owners and deadlines alongside the rest of your DORA programme? Start your 14-day free trial of Enactia’s AI-powered GRC platform, no credit card needed.
How should a CISO prepare for DORA TLPT?
Map critical or important functions to supporting systems and providers, build a discreet control team, secure budget for external providers, and set up a remediation process before notification. Good preparation turns TLPT from a disruption into a structured improvement cycle.
TLPT readiness checklist
- Confirm exposure. Check whether your entity, or a group entity, meets the Article 2 criteria and ask your competent authority how it applies them.
- Map critical or important functions. Link each function to the applications, infrastructure, people and third parties that support it. Your DORA register of information is a good starting point for third-party dependencies.
- Engage key ICT providers early. Review contracts for TLPT participation rights under DORA’s ICT third-party requirements, and track them in your third-party risk management process.
- Name the control team lead. Choose a senior person who can keep the test confidential and make fast decisions, and agree escalation rules with management.
- Prepare procurement. Pre-qualify threat intelligence and red team providers against the RTS criteria, including experience, references and insurance.
- Assess test risks. Document risk controls for live testing, including stop conditions, backups, restoration plans and legal clearances.
- Plan communications. Decide how and when the blue team, management body and providers are informed at closure.
- Set up remediation tracking. Record each finding with an owner, deadline and evidence in your ICT risk register so the remediation plan can be produced quickly.
- Link to incident response. Make sure a real incident during the test can be distinguished from test activity and handled through your incident management workflow.
- Brief the management body. DORA makes the management body responsible for ICT risk; it should understand the test’s purpose, cost and outcomes.
How does TLPT relate to TIBER-EU?
TIBER-EU is the European framework for threat intelligence-based ethical red teaming that inspired DORA TLPT. It has been updated to align fully with the DORA RTS. Authorities that already run TIBER programmes can build on that experience.
The ECB’s TIBER-EU page states that the framework was updated to ensure full alignment with the RTS on TLPT. For entities that have already completed a TIBER test, the process will feel familiar, but check with your authority how past tests are treated and when your next DORA TLPT cycle starts.
For a wider view of how testing fits with ICT risk, incident reporting and third-party oversight, see our overview of DORA compliance in 2026 and the DORA framework page.
Key takeaways
- DORA TLPT applies only to financial entities identified by their TLPT authority using the Article 2 criteria in Delegated Regulation 2025/1190.
- Tests must run at least every three years, on live production systems, covering several or all critical or important functions.
- Active red teaming lasts at least 12 weeks, followed by closure, purple teaming and a remediation plan.
- Threat intelligence providers must be external; significant SSM banks must use external testers only.
- Preparation, especially function mapping and third-party engagement, should start before notification arrives.
Frequently asked questions
Does every financial entity need to perform DORA TLPT?
No. All in-scope entities need a digital operational resilience testing programme under Articles 24 and 25, but TLPT under Article 26 applies only to entities identified by their competent or TLPT authority. The RTS sets criteria based on systemic importance, size thresholds and ICT risk, and authorities can include or exclude entities based on their assessment.
How long does a DORA TLPT take?
The active red team testing phase must last at least 12 weeks. Adding preparation, threat intelligence, closure and remediation, the full process from the authority’s notification to the remediation plan typically takes well over a year. The RTS sets deadlines for key steps, such as delivering the red team report within four weeks of testing ending.
Can we use our own staff as TLPT testers?
Only under conditions. DORA allows internal testers if the authority approves, conflicts of interest are managed and the threat intelligence provider is external. External testers must be used every three tests, and credit institutions classified as significant under the Single Supervisory Mechanism must use external testers only. The RTS also sets team size and tenure requirements.
Do ICT third-party providers have to take part?
Where a provider supports critical or important functions within the test scope, Article 26 of DORA requires the financial entity to ensure the provider participates. If direct participation could affect the provider’s other clients or confidentiality, pooled testing led by one financial entity is allowed. Check that your contracts support this.
What happens after a TLPT is completed?
After closure the entity submits a test summary report and a remediation plan to the TLPT authority, which then issues an attestation confirming the test met the requirements. The attestation supports mutual recognition between authorities. It does not mean the authority has approved the entity’s overall ICT risk management.
Turning TLPT into lasting resilience
DORA TLPT is demanding, but it gives the management body something few other exercises can: evidence of how the organisation performs against a realistic attacker on its real systems. The value comes after the test, when findings are prioritised, fixed and verified, and when lessons feed back into the ICT risk framework and the basic testing programme.
If you want to manage DORA testing, remediation and third-party evidence in one connected programme, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
