TLPT obligation (Art. 26 DORA):
Significant financial institutions are required by BaFin / Deutsche Bundesbank to conduct Threat-Led Penetration Tests - at least every three years. The authority may shorten this cycle.
DORA Art. 26 · TIBER-DE · RTS 2025/1190
Threat-Led Penetration Testing - DORA TLPT under TIBER-DE
DORA Art. 26 obliges significant financial institutions to conduct Threat-Led Penetration Tests against live production systems. The DORA-TLPT-RTS (EU 2025/1190, in force from 8 July 2025) specifies requirements for RTT providers, TI providers and the three-phase process. AWARE7 conducts these regulatory-recognised engagements as a qualified RTT provider under TIBER-DE - with transparent methodology and a binding fixed-price quote.
- 17
- RTS articles
- Regulation EU 2025/1190
- 12+
- weeks testing
- minimum (RTS)
- 5
- years experience
- required for RT test leader
- 10
- weeks purple team
- deadline from test end
- 3×
- TLPT cycle
- at least every 3 years
- 500+
- pentests
- AWARE7 references
Regulatory Framework
DORA Art. 26 and the TLPT-RTS 2025/1190
EU Regulation (EU) 2022/2554 (DORA) has been directly applicable since 17 January 2025. The Commission Delegated Regulation (EU) 2025/1190 - the DORA-TLPT-RTS - specifies Art. 26 with 17 articles and 8 annexes. It entered into force on 8 July 2025.
No.RequirementDetails
Live production systems (no staging):
TLPT is directed exclusively against live production systems that host critical functions (CIF) of the institution. Test environments and staging systems do not fulfil the regulatory requirement.
RTT and TI providers: qualification obligation (RTS Art. 5):
The Red Team Test Leader must demonstrate at least 5 years of proven experience in penetration testing/red teaming and 5 documented reference engagements. Team size: at least 3 persons each with ≥ 2 years of experience. Recognised certifications: OSCP+, CREST CCRTS, GIAC GCIH, CompTIA PenTest+.
Provider independence (Art. 26(9) DORA):
The RTT provider and TI provider must be fully independent of each other and may not have any economic connection to the entity being tested. Group membership precludes engagement.
Involving third-party providers (Art. 26(8) DORA):
If critical ICT functions are outsourced to external providers (e.g. cloud providers, core banking SaaS), these must be included in the TLPT scope definition. The financial institution remains responsible for the overall process.
Regulatory oversight and closure report:
Scope, methodology and results are coordinated with the authority. After completion of the closure phase, a closure report must be submitted containing purple team findings, remediation plan and MITRE ATT&CK documentation.
RTS 2025/1190: Commission Delegated Regulation (EU) 2025/1190 was published in the EU Official Journal on 13 February 2025 and has been in force since 8 July 2025. It supersedes the previous TIBER-EU guidelines as the binding legal basis. TIBER-DE was fully aligned with it in February 2025.
Timeline
Deadlines and milestones after authority notification
After official notification by BaFin or Deutsche Bundesbank, binding deadlines begin. Typical total duration: 5-7 months.
DeadlineMilestoneDetails
Milestone
Authority notification
BaFin or Deutsche Bundesbank (TCT) identifies the institution and initiates the TLPT process. The institution selects the RTT provider (AWARE7) and TI provider.
Milestone
Nominate control team
The white team (control team) must be reported to the authority. It typically consists of CISO, board/management and legal/compliance. Kick-off RTT provider: Generic Threat Landscape (GTL) commences.
Milestone
Generic Scope Document (GSD) submitted
Scope for Scoping Document (SSD) / Generic Scope Document with defined critical functions (CIF) is agreed with the authority and submitted. TI provider begins threat intelligence collection.
Milestone
Red Team Test - minimum 12 weeks
TI provider delivers the Targeted Threat Intelligence Report (TTI). AWARE7 red team commences attack simulation against live production systems. MITRE ATT&CK documentation of all techniques, tactics and artefacts.
Milestone
Purple team exercises completed
Mandatory deadline: within 10 weeks after end of active test phase, purple team exercises must be conducted and documented. Red team and SOC jointly work through attack chains and detection improvements.
Milestone
Closure report submitted to authority
Closure report with findings, remediation plan, purple team results and MITRE ATT&CK mapping is submitted to BaFin / Deutsche Bundesbank (TCT). Lessons-learned session with board and CISO.
Comparison
DORA TLPT vs. conventional penetration test
TLPT is not an extension of a pentest - it is a fundamentally different testing methodology.
Swipe table horizontally
| Characteristic | Regulatory DORA TLPT | Market standard Conventional pentest |
|---|---|---|
| Basis | Real threat intelligence (TTI report) | Standard methodology (OWASP, PTES) |
| Systems | Live production (mandatory under RTS) | Staging / production - selectable |
| Blue team | Uninformed (realistic condition) | Often informed |
| Scope | Critical functions (CIF) | Freely definable |
| Regulation | Authority approves, closure report to BaFin | No regulatory framework |
| Duration | 5-7 months (min. test phase 12 weeks) | 3-10 days |
| TI provider | Mandatory (independent, RTS Art. 5) | Not required |
| Purple team | Mandatory within 10 weeks after test end | Optional |
| Recognised for | DORA Art. 26 evidence (regulatory) | ISMS audit, ISO 27001, NIS-2 |
| Cost | €140,000-560,000 (market average) | €5,000-50,000 |
Process
The TIBER-DE process in three phases
TIBER-DE prescribes a three-part process. AWARE7 fulfils the RTT role (Red Team Test provider).
No.PhaseDurationContent
Phase
Preparation Phase
Duration
4-6 weeks
- A Scope definition jointly with white team and supervisory authority (BaFin / Deutsche Bundesbank TCT)
- B CIF assessment: 4-dimensional analysis of critical functions
- C Engagement of the independent TI provider (mandatory under RTS Art. 5)
- D RTT kick-off: Generic Threat Landscape (GTL) by AWARE7
- E Sign Rules of Engagement (RoE), create Generic Scope Document (GSD)
Phase
Testing Phase
Duration
≥ 12 weeks (RTS mandatory)
- A TI provider delivers Targeted Threat Intelligence Report (TTI) based on dark web sources, OSINT and sector intelligence
- B AWARE7 red team plans campaign based on the TTI - institution-specific, no generic attacks
- C Active attack simulation against live production systems (critical functions)
- D MITRE ATT&CK documentation of all techniques, tactics, procedures (TTPs) with timestamps
- E Ongoing briefing of white team (blue team / SOC remains uninformed)
Phase
Closure Phase
Duration
4-6 weeks
- A Purple team exercises (mandatory within 10 weeks after end of active phase): replaying attack chains jointly with SOC/blue team
- B Remediation planning and prioritised recommendations for action
- C Preparation of closure report in accordance with TIBER-DE / RTS 2025/1190 requirements
- D Submission to BaFin / Deutsche Bundesbank (TCT) - evidence of DORA Art. 26 fulfilment
- E Lessons-learned session with board and CISO
Scope Core
Critical or Important Functions (CIF) - the scope core of every TLPT
DORA Art. 2 and RTS Art. 8-12 define which functions are to be classified as Critical or Important Functions (CIF). The CIF assessment is the basis of the entire scope definition and is carried out jointly with the white team and the authority during the preparation phase.
1. Financial stability
Functions whose failure would endanger the financial stability of the institution or the financial sector - e.g. liquidity management, capital calculation, supervisory reporting.
2. Systemic interconnection
Functions that, if compromised, would have systemic impact on other market participants - e.g. interbank clearing, TARGET2 interfaces, CCPs.
3. Replaceability
Functions that cannot be taken over by replacement systems within a reasonable timeframe - e.g. proprietary core banking systems without redundancy, critical trading platforms.
4. Regulatory continuity
Functions essential for supervisory reporting and compliance - e.g. reporting systems, AML/KYC infrastructure, MiFID reporting.
Typical CIF systems in practice:
Core banking system · Payment processing · TARGET2 connection · Online banking platform · Trading platform · Authentication infrastructure · Reporting system · AML/KYC engine · Clearing & Settlement · Mobile banking app
Why AWARE7
Why AWARE7 as RTT provider under RTS 2025/1190?
The DORA-TLPT-RTS sets clear requirements for red team test providers. AWARE7 meets all of them.
01
OSCP+-certified team
11 offensive security consultants, including 4 × OSCP+ (OffSec). Multiple CVE authors (Adobe, WooCommerce, Pi-hole). Led by Vincent Heinen, M.Sc. IT Security (RUB), Head of Offensive Services. Meets RTS Art. 5: RT test leader ≥ 5 years, team size ≥ 3 persons.
02
Financial sector references (BaFin-regulated)
Engagements at BaFin-regulated institutions - including multi-year red team exercises for credit institutions and payment service providers under regulatory requirements. More than 500 completed penetration test projects.
03
ISO 27001 certified (since 2022)
AWARE7 GmbH is certified to ISO/IEC 27001:2022. Auditors, clients and authorities accept our ISMS certification as a quality credential. Important for RTT provider qualification under TIBER-DE procurement guidelines.
04
Hiscox E&O insurance (mandatory evidence)
Professional indemnity insurance (Errors & Omissions) with Hiscox SA for €3,000,000 under the NET IT by Hiscox product. Mandatory evidence in the TIBER-DE procurement process - verifiable by authority and white team.
05
MITRE ATT&CK documentation
Complete documentation of all attack techniques under MITRE ATT&CK Enterprise: tactics, techniques, procedures (TTPs) with timestamps and artefacts. RTS-compliant closure report included. Purple team preparation from day one.
06
Data stored in Germany
AWARE7 is a German company based in Gelsenkirchen. All test data is processed exclusively on German servers. No data transfer to third countries - relevant for BSI-KRITIS, regulatory data protection requirements and banking secrecy.
Affected Institutions
Which institutions are affected by DORA TLPT?
RTS Art. 2 (EU 2025/1190) sets objective thresholds. Beyond these, the authority designates further institutions based on a risk analysis.
Automatically included under RTS Art. 2:
- O-SII / G-SIB:
- Systemically important credit institutions and investment firms under direct ECB supervision (SSM) are automatically required to conduct TLPT.
- Insurance undertakings:
- Non-life and life reinsurers with gross written premiums (GWP) exceeding €500 million.
- Payment service providers:
- Payment institutions and e-money institutions with a transaction volume exceeding €120 billion per year.
Systemically important banks
O-SII/G-SIB automatically; others following BaFin risk assessment
Insurance undertakings
BaFin-supervised primary and reinsurers > €500m GWP
Payment service providers
Payment institutions, e-money institutions > €120bn transaction volume
Investment firms
CRR investment firms and larger investment houses
Central counterparties
CCPs, central securities depositories (CSDs), trading venues
On regulatory direction
Smaller institutions may be included by regulatory order
Exempt under DORA Art. 16 are small non-interconnected financial institutions. The exact classification is made by BaFin or Deutsche Bundesbank.
Budget
Costs and budget planning for DORA TLPT
TLPT engagements are substantially more extensive than conventional penetration tests - the costs reflect duration, team size and regulatory overhead.
No.ComponentRangeFactors
Component
RTT provider (AWARE7)
Range
€80,000 - €300,000
Scope complexity, number of CIF systems, duration of active phase (min. 12 weeks), team size (min. 3 persons per RTS)
Component
TI provider (separate)
Range
€30,000 - €80,000
Targeted Threat Intelligence Report (TTI): dark web research, OSINT, malware analysis, sector intelligence. Must be independent of the RTT provider.
Component
Internal coordination costs
Range
€30,000 - €180,000
White team effort, legal/compliance, external legal advice, authority coordination, CISO time, remediation implementation
Σ
Total TLPT cost: €140,000 - €560,000
Market average for first TLPT engagements at large German banks: approx. €300,000-450,000. AWARE7 provides a binding fixed-price quote - no hourly rates, no retrospective claims. Quote within 48 hours of initial consultation.
International
TIBER-DE in international comparison
TIBER-DE is part of a global ecosystem of regulatory red team frameworks. All follow the three-phase approach and mandate genuine threat intelligence.
Swipe table horizontally
| Framework | Country / Region | Authority | Since | Basis |
|---|---|---|---|---|
| TIBER-DE | Germany | Deutsche Bundesbank / BaFin | 2019 | TIBER-EU / DORA |
| CBEST | United Kingdom | Bank of England | 2014 | Standalone |
| TIBER-EU | EU (cross-border) | ECB | 2018 | Reference framework |
| TIBER-NL | Netherlands | DNB | 2016 | TIBER-EU |
| TIBER-SE | Sweden | Riksbank | 2020 | TIBER-EU |
| TIBER-BE | Belgium | BNB | 2019 | TIBER-EU |
| iCAST | Hong Kong | HKMA | 2021 | CBEST/TIBER-EU |
| CORIE | Australia | RBA / APRA | 2020 | Standalone |
A TIBER-DE completion can in certain constellations be mutually recognised across multiple EU jurisdictions - particularly for institutions with subsidiaries in several EU member states.
FAQ
Frequently asked questions about DORA TLPT and TIBER-DE
What is TLPT under DORA (Art. 26)?
Threat-Led Penetration Testing (TLPT) is a mandatory assessment for significant financial institutions under the DORA Regulation (EU) 2022/2554, Art. 26. Unlike a classical penetration test, TLPT is based on genuine threat intelligence (Targeted Threat Intelligence) about current adversaries specifically targeting the institution or the sector. The red team simulates these real-world adversaries against live production systems - including critical functions such as payment processing or core banking systems. The entire process is under regulatory oversight and must be reported to the competent authority (BaFin / Deutsche Bundesbank).
Which financial institutions are required to conduct TLPT under DORA?
Art. 26 DORA obliges those financial institutions that are identified by the competent authority (in Germany: BaFin or Deutsche Bundesbank) on the basis of a risk assessment. The DORA-TLPT-RTS (Regulation EU 2025/1190, in force from 8 July 2025) specifies thresholds: automatically included are credit institutions and investment firms of the O-SII/G-SIB category, insurance undertakings with a GWP exceeding €500 million, and payment service providers with a transaction volume exceeding €120 billion. Small non-interconnected institutions are exempt. Affected institutions must conduct TLPT at least every three years.
What is the difference between TLPT and a conventional penetration test?
A conventional penetration test examines defined systems for known vulnerabilities - the scope is narrow, the blue team is usually informed, the methodology is standardised, and the duration is 3-10 days. TLPT goes fundamentally further: (1) It is based on a specific Targeted Threat Intelligence Report (TTI) by a certified TI-provider for that specific institution; (2) testing is against live production systems, not staging; (3) the blue team (SOC) does not know that a test is taking place; (4) the entire process takes 5-7 months including preparation, active testing phase (minimum 12 weeks) and purple-team closure; (5) scope, methodology and results are coordinated with BaFin / Deutsche Bundesbank.
What is TIBER-DE and how does it relate to DORA?
TIBER-DE (Threat Intelligence-Based Ethical Red-Teaming) is the Deutsche Bundesbank's framework for regulatory-recognised red team tests in the German financial sector. It was introduced in 2019 and fully aligned with DORA TLPT requirements in February 2025. TIBER-DE is the methodology approved in Germany for fulfilling the DORA Art. 26 obligation. Engagements under TIBER-DE are coordinated by the TIBER Cyber Team (TCT) of the Bundesbank and recognised by the supervisory authority.
How does a TIBER-DE / DORA-TLPT engagement proceed?
A TIBER-DE engagement is structured in three mandatory phases: (1) Preparation Phase (4-6 weeks after authority notification): scope definition with the authority, control team nomination (deadline: 3 months), white team setup, TI-provider engagement, Generic Scope Document (GSD, deadline: 6 months). (2) Testing Phase (minimum duration 12 weeks): TI-provider delivers the TTI report, AWARE7 red team plans campaign and commences active attack simulation against live production systems, MITRE ATT&CK documentation of all techniques. (3) Closure Phase: purple team exercises (mandatory, within 10 weeks after end of active phase), remediation plan, closure report and submission to BaFin / Deutsche Bundesbank. Total duration: typically 5-7 months.
Does AWARE7 need to be formally accredited as an RTT provider by the Bundesbank?
There is no formal state accreditation for TIBER-DE RTT providers. The selection lies with the financial institution, which qualifies the RTT provider based on TIBER-DE procurement guidelines and RTS requirements. The Bundesbank (TCT) reviews whether the provider meets the requirements during the scope definition phase. Under RTS Art. 5, the Red Team Test Leader must have at least 5 years of relevant experience and 5 proven references. Further requirements: recognised offensive certifications (e.g. OSCP+, CREST CCRTS), adequate professional indemnity insurance and full independence from the entity being tested.
What qualifications does AWARE7 bring for DORA TLPT?
AWARE7 meets all RTS requirements for RTT providers: (1) Offensive security team with 11 consultants, including 4 × OSCP+ (OffSec), multiple CVE authors (Adobe, WooCommerce, Pi-hole); (2) ISO/IEC 27001:2022 certification; (3) professional indemnity insurance with Hiscox (€3m E&O, NET IT); (4) demonstrated red team experience at BaFin-regulated financial institutions (credit institutions, insurers, payment service providers); (5) application of the TIBER-DE methodology in past engagements under the leadership of Vincent Heinen (Head of Offensive Services, M.Sc. IT Security, RUB); (6) MITRE ATT&CK documentation for every engagement; (7) data stored in Germany.
What are Critical or Important Functions (CIF) under DORA TLPT?
Critical or Important Functions (CIF) are the core of every TLPT scope. Under DORA Art. 2 and the RTS, functions are classified as critical if: (1) their failure would endanger the financial stability or regulatory continuity of the institution; (2) their compromise would have systemic impact on other market participants; (3) they could not be taken over by replacement systems within a reasonable time; or (4) they are essential for regulatory reporting. Typical CIF: core banking system, payment processing, authentication infrastructure, operational trading platforms, supervisory reporting. The CIF assessment is carried out jointly with the white team and the authority during the preparation phase.
How many systems are tested during TLPT?
TLPT under DORA targets the critical functions (CIF) of the institution - the systems that would have systemic consequences if disrupted or compromised. Scope typically covers core banking systems, payment infrastructure, authentication systems and operational databases. The precise scope definition takes place in the preparation phase together with the white team and the supervisory authority in the Generic Scope Document (GSD). Testing is exclusively against live production systems - no staging, no test environment.
What does a DORA TLPT / TIBER-DE engagement cost?
TIBER-DE-compliant engagements start at AWARE7 as RTT provider from approx. €80,000 (net). The market range for RTT providers is typically between €80,000 and €300,000 - depending on scope complexity, duration of the active phase (minimum 12 weeks) and team size. The separately commissioned costs of the TI-provider for the TTI report (typically €30,000-80,000) are additional. A complete TLPT engagement therefore falls within a market average of €140,000-560,000. AWARE7 provides a binding fixed-price quote - no hourly rates, no retrospective claims.
What is the white team in TLPT?
The white team is the coordination unit of the institution that has the full overview of the engagement. It typically consists of senior management/board, CISO and optionally legal/compliance. The white team acts as the link between the RTT provider, TI-provider and supervisory authority. It approves the scope, knows the test period and makes emergency decisions. The operational IT/security team (blue team/SOC) is deliberately kept uninformed to ensure realistic detection conditions.
Can internal red teams conduct TLPT?
Under RTS Art. 6, institutions may use internal testers under certain conditions: the internal red team must be fully separated from the function it is testing. For significant credit institutions under direct ECB supervision (SSM institutions): they must always engage external RTT providers. For other institutions: a maximum of two consecutive TLPTs may be conducted internally; the third must be external. The qualification requirements under RTS Art. 5 apply to internal testers identically as to external providers.
What is a purple team exercise in DORA TLPT?
The purple team phase is a mandatory component of every TLPT under the RTS and TIBER-DE and must take place within 10 weeks of the end of the active test phase. In the purple team exercise, attack chains are replayed jointly by the red team (AWARE7) and the blue team (SOC of the institution): the red team shows how an attack played out - the blue team learns how it should have been detected and stopped. The objective is knowledge transfer, detection improvement and preparation of the remediation plan. Without documented purple team exercises, the TLPT closure is not recognised by the regulator.
Are there international equivalents to TIBER-DE?
Yes - TIBER-DE is part of a global ecosystem of comparable frameworks: CBEST (UK, since 2014, Bank of England), TIBER-NL (Netherlands, DNB), TIBER-SE (Sweden, Riksbank), TIBER-BE (Belgium, BNB), TIBER-DK (Denmark), iCAST (Hong Kong, HKMA), CORIE (Australia, RBA). All follow the three-phase approach (Preparation / Testing / Closure), mandate genuine threat intelligence and have a 3-year cycle. TIBER-EU (ECB) is the overarching reference framework from which DORA Art. 26 is methodically derived. A TIBER-DE completion can in certain constellations be mutually recognised across multiple jurisdictions.
What deadlines apply after the authority notification?
After notification by BaFin / Deutsche Bundesbank, the following binding deadlines apply: (1) 3 months: Control Team (white team) must be nominated and reported to the authority. (2) 6 months: Generic Scope Document (GSD) / Scope for Scoping Document (SSD) must be agreed and submitted. (3) Active test phase: minimum duration 12 weeks (specified by RTS). (4) Purple team exercises: mandatory, within 10 weeks after end of active phase. (5) Closure report: submission to the authority after completion of the closure phase. Total duration from notification to closure: typically 5-7 months.
What does the DORA-TLPT-RTS (Regulation EU 2025/1190) govern?
Commission Delegated Regulation (EU) 2025/1190 (DORA-TLPT-RTS) was published on 13 February 2025 and entered into force on 8 July 2025. It contains 17 articles and 8 annexes and specifies the DORA Art. 26 requirements: (1) Article 2: Thresholds for affected institutions. (2) Article 5: Qualification requirements for RTT and TI providers (5 years' experience, 5 references for test leader). (3) Article 6: Conditions for internal testers. (4) Articles 8-12: CIF assessment framework and scope process. (5) Articles 13-15: Requirements for the TTI report. (6) Annexes 1-8: Templates for GSD, TTI report, closure report and other mandatory documents.
Your contact for DORA TLPT
M.Sc. in IT Security with more than 5 years of experience in offensive security analysis. Leads the delivery of penetration tests, specializing in web applications, network infrastructure, reverse engineering and hardware security. Responsible for several responsible disclosures.
OSCP+ OSCP OSWP OSWA
Fixed-price quote in 48h
Planning a DORA TLPT?
We discuss scope, CIF assessment, timeline and authority coordination - free and non-binding. You receive a binding fixed-price quote within 48 hours.
