How to prepare for a TLPT engagement

Get the baseline right first

Keep routine vulnerability management and testing active while preparing TLPT. Article 24 requires covered entities to maintain a testing and remediation programme. Address urgent known weaknesses promptly and discuss remaining findings and their implications with the control team and test managers. An unresolved backlog does not by itself justify delaying a required TLPT. See TLPT vs penetration testing for their different purposes and what TLPT is for scope.

Understand the statutory clock

Once your competent authority notifies you, the deadlines in Commission Delegated Regulation (EU) 2025/1190 start running. They are not milestones you negotiate with a provider.

TLPT milestones and their deadlines

Milestone	Deadline	Source
TLPT initiation information	Within 3 months of the authority’s notification	Reg. 2025/1190 Art 9(2)
Scope specification document, approved by the management body	Within 6 months of the notification	Art 9(6)
Threat intelligence gathering	Approximately 4 weeks	Reg. 2025/1190 recital; TIBER-EU
Active red team testing	At least 12 weeks	Art 11(5)
Red team test report	Within 4 weeks of the end of active testing	Art 12(2)
Blue team test report	No later than 10 weeks after the end of active testing	Art 12(4)
Replay and purple teaming	No later than 10 weeks after the end of active testing	Art 12(5)
Summary of relevant findings	Within 8 weeks of the authority’s notification that the reports are complete	Art 12(7)
Remediation plans and supporting documentation	Within 8 weeks of that notification	Art 13(1)

Plan the dependencies rather than adding every maximum together. TIBER-EU allows no more than six months for preparation from the notified start date, and active testing lasts at least twelve weeks. Closure tasks partly overlap: the summary and remediation plan share the same eight-week deadline after the authority’s report-assessment notification. The overall duration depends on preparation, testing and authority review; a remediation plan is distinct from completing every corrective action. The engagement timeline shows how the phases sit against one another.

Stand up the control team

The small group that runs the test is the control team – the delegated regulation’s term, though some organisations still say white team. Article 4(1) requires you to appoint a control team lead – defined at Article 1(2) as the staff member responsible for the conduct of all TLPT-related activities – to run the test day to day and own the control team’s decisions. Pick that person before you pick a provider.

Article 4(2) then constrains who may know. Access to information about a planned or ongoing TLPT is limited, on a need-to-know basis, to the control team, the management body, the testers, the threat intelligence provider and the TLPT authority. The control team must consult the test managers before involving any blue team member, must be told of any detection of the test by staff and contain the resulting incident-response escalation, and must extend secrecy arrangements to entity staff, relevant third-party provider staff, the testers and the intelligence provider. Where possible everyone refers to the test by code name only – including in calendar entries, tickets and invoices, which is where tests leak.

Choose providers who can actually be appointed

Not every penetration testing firm qualifies. DORA Article 27(1) and Article 7(1) of the delegated regulation set a documentary bar worth checking before commercial discussions, not after.

• Highest suitability and reputability, with demonstrated expertise in threat intelligence, penetration testing and red team testing (Art 27(1)(a)–(b)), evidenced by detailed CVs and certifications under recognised market standards (Art 7(1)(a)).
• Certification by an accreditation body in a Member State, or adherence to formal codes of conduct or ethical frameworks (Art 27(1)(c)).
• An independent assurance or audit report on sound risk management, covering protection of confidential information (Art 27(1)(d)).
• Professional indemnity insurance covering misconduct and negligence (Art 27(1)(e); Art 7(1)(b)).
• References: at least three from the threat intelligence provider (Art 7(1)(c)) and at least five from external testers (Art 7(1)(d)).

If you are considering internal testers

You may, under conditions. DORA Article 27(2) requires approval by the relevant competent authority or the designated single authority, verification that you have sufficient dedicated resources and have avoided conflicts of interest across design and execution, and a threat intelligence provider external to the entity. Article 15(1) adds a documented, periodically reviewed policy on suitability, competence and conflicts of interest; a test team of a test lead plus at least two additional members; and employment by the entity or an ICT intra-group service provider for the preceding 12 months (testers at an intra-group provider count as internal, Art 15(4)). Nor does it last: DORA Article 26(8) requires you to “contract external testers every three tests”.

Write the rules of engagement from the named risks

Generic boundary-setting is a weak substitute for the risk list Article 5 actually names. During preparation the control team must assess the risks of testing live production systems, including potential impacts on the financial sector and on financial stability at Union or national level, and must review them throughout. Those named risks are your agenda:

• Granting testers access to sensitive information.
• Failing to obtain the attestation because of non-compliance, confidentiality breaches or a lack of ethical conduct.
• Crisis and incident escalation triggered by the test.
• Interruption of critical activities and data corruption caused by the red team.
• The same interruption and corruption caused by the blue team responding to what it believes is a real attack.
• Incomplete restoration of systems after the test.

That fifth item is the one most engagements underestimate. A blue team that isolates a production segment, revokes credentials at scale or fails over a payments platform can do more damage than the testers – while doing exactly what you trained it to do. Decide in advance who can stop the test, how, and how fast.

Scope, and who signs it off

You assess which critical or important functions to cover, and under DORA Article 26(2) that assessment determines the scope, which “shall be validated by the competent authorities”. Two things follow. The scope specification document needs approval from your management body, not just the CISO (Art 9(6)) – book that meeting early. And if a critical function runs on an ICT third-party provider, Article 26(3) requires you to secure its participation while keeping full responsibility, while Article 26(4) allows a pooled test contracted by the provider where its participation would otherwise harm customers outside DORA scope.

After the active phase

The clocks are all in the milestone table above; what follows is what each stage actually asks of you.

1. Receive the red team test report (Art 12(2)), then the blue team report (Art 12(4)) – two accounts of the same weeks, written independently of each other.
2. Run the replay and purple teaming (Art 12(5)): blue team and testers walk through the offensive and defensive actions together, covering the vulnerabilities found and what could not be tested.
3. Submit the summary of relevant findings once the authority confirms both reports are complete (Art 12(7), DORA Art 26(6)).
4. Submit remediation plans and supporting documentation (Art 13(1)).
5. Receive the attestation, whose content is set out in Annex VIII and which the lead TLPT authority issues where several are involved (Art 14).

The replay is where the money is. Its findings feed straight into the test summary report and the remediation plan, and it is the only point at which your defenders see the attack path they were partly blind to. Budget real time for it. Remember too that the outcome is not a pass or fail, and that under DORA Article 26(7) the attestation exists to allow mutual recognition between competent authorities – while you stay fully responsible for the impact of the tests.