Skip to content

Services, Wiki-Artikel und Blog-Beiträge durchsuchen

↑↓NavigierenEnterÖffnenESCSchließen

DORA Art. 26 · TIBER-DE · RTS 2025/1190

Threat-Led Penetration Testing - DORA TLPT under TIBER-DE

DORA Art. 26 obliges financial entities identified by the competent authority to conduct Threat-Led Penetration Tests against live production systems. The DORA-TLPT-RTS (EU 2025/1190, in force from 8 July 2025) specifies requirements for RTT providers, TI providers and the three-phase process. AWARE7 conducts these regulatory-recognised engagements as a qualified RTT provider under TIBER-DE, with transparent methodology and a binding fixed-price quote.

Schedule initial consultation Red Teaming overview
17
RTS articles
Regulation EU 2025/1190
12+
weeks testing
minimum (RTS)
5
years experience
required for RT test leader
10
weeks purple team
deadline from test end
3×
TLPT cycle
at least every 3 years
500+
pentests
AWARE7 references

Regulatory Framework

DORA Art. 26 and the TLPT-RTS 2025/1190

EU Regulation (EU) 2022/2554 (DORA) has been directly applicable since 17 January 2025. The Commission Delegated Regulation (EU) 2025/1190 - the DORA-TLPT-RTS - specifies Art. 26 with 17 articles and 8 annexes. It entered into force on 8 July 2025.

01

TLPT obligation (Art. 26 DORA):

Financial entities identified by the competent authority are required to conduct Threat-Led Penetration Tests, at least every three years. The competent authority may, where necessary, request the financial entity to reduce or increase this frequency (DORA Art. 26(1)).

02

Live production systems (no staging):

Each TLPT shall cover several or all critical or important functions (CIF) of a financial entity, and shall be performed on live production systems supporting such functions (DORA Art. 26(2)).

03

RTT and TI providers: qualification obligation (RTS Art. 7):

The red team must consist of at least a manager with ≥ 5 years of experience in penetration testing and red team testing and at least two additional testers each with ≥ 2 years of experience. External testers provide a combined minimum of 5 references from previous assignments. Providers present certifications according to recognised market standards appropriate for the performance of their activities (RTS Art. 7(1)(a)(f)).

04

Provider independence (DORA Art. 27, RTS Art. 7):

The threat intelligence provider (TI provider) must not belong to the financial entity or its intragroup ICT service providers. Staff assigned by both providers must be separated from each other for the same TLPT and may not perform any blue team tasks for the financial entity (RTS Art. 7(1)(e)(f)).

05

Involving third-party ICT service providers (Art. 26(3) DORA):

Where ICT third-party service providers are included in the scope of TLPT, the financial entity shall take the necessary measures and safeguards to ensure the participation of such ICT third-party service providers and shall retain at all times full responsibility for ensuring compliance with this Regulation (DORA Art. 26(3)).

06

Regulatory oversight and summary report (Annex VII):

Scope, methodology and results are coordinated with the authority. After the TLPT authority notifies the control team lead that the red team and blue team test reports are complete, the financial entity shall within 8 weeks submit the summary report (Annex VII) containing attack paths, tactics and techniques applied, and a remediation plan (RTS Art. 12(7), Art. 13, Annex VII).

RTS 2025/1190: Commission Delegated Regulation (EU) 2025/1190 was adopted by the Commission on 13 February 2025, published in the Official Journal on 18 June 2025 and has been in force since 8 July 2025. Financial entities may refer to the TIBER-EU framework or one of its national implementations, provided these are consistent with Art. 26 and 27 DORA and the Regulation. The Bundesbank updated TIBER-DE in July 2025 (version 4.0): since then, the TIBER-EU framework applies directly to TIBER-DE tests.

Timeline

Deadlines and milestones after authority notification

After official notification by BaFin or Deutsche Bundesbank, binding deadlines begin. The total duration follows from the individual deadlines in the regulation: preparation up to 6 months, active test minimum 12 weeks, and a closure phase with up to 10 weeks for blue team reporting, then 8 weeks each for the summary report and remediation plan.

Day 0

Milestone

Authority notification

The TLPT authority requires the financial entity to conduct a TLPT (Art. 9(1) RTS 2025/1190). The providers are selected by the control team in the preparation phase; prior to contracting, the control team provides the test managers with evidence of provider compliance (Art. 9(11)).

3 months

Milestone

Submit initiation information

Initiation information (project charter and contact details of the control team lead) must be submitted to the test managers within 3 months (Art. 9(2) RTS 2025/1190). The TLPT authority validates the information; the full control team is set up after validation. Where the TLPT authority has provided a Generic Threat Landscape (GTL) for the financial sector, the TI provider may use it as a baseline (RTS Art. 10(1)).

6 months

Milestone

Scope specification document submitted

The scope specification document (Annex II) must be submitted to the test managers within 6 months of receiving the notification (Art. 9(6) RTS 2025/1190). The TLPT authority approves the document in a subsequent step (Art. 9(12)). The TI provider begins threat intelligence collection after approval.

Active phase

Milestone

Red Team Test - minimum 12 weeks

The TI provider delivers the targeted threat intelligence report (TTIR). AWARE7 red team commences attack simulation against live production systems. Documentation of attack paths and tactics, techniques and procedures (TTPs) with timestamps.

+10 weeks

Milestone

Purple team exercises completed

Mandatory deadline: within 10 weeks after end of active test phase, purple team exercises must be conducted and documented. Red team and SOC jointly work through attack chains and detection improvements.

Closure

Milestone

Summary report submitted to authority

The summary report (Annex VII RTS 2025/1190) and remediation plan are submitted within 8 weeks each to the TLPT authority (BaFin / Bundesbank TCT) after the authority confirms the red team and blue team test reports are complete (Art. 12(7), Art. 13). The authority then issues the attestation (Art. 14 RTS 2025/1190).

Comparison

DORA TLPT vs. conventional penetration test

TLPT is not an extension of a pentest - it is a fundamentally different testing methodology.

Swipe table horizontally

Characteristic Regulatory DORA TLPT Market standard Conventional pentest
Basis Real threat intelligence (targeted threat intelligence report, TTIR) Standard methodology (OWASP, PTES)
Systems Live production (mandatory under RTS) Staging / production - selectable
Blue team Uninformed (realistic condition) Often informed
Scope Critical functions (CIF) Freely definable
Regulation Authority approves, summary report (Annex VII) and remediation plan submitted to TLPT authority No regulatory framework
Duration Several months: preparation up to 6 months, active test minimum 12 weeks 3-10 days
TI provider Mandatory (external and independent, RTS Art. 7) Not required
Purple team Mandatory within 10 weeks after test end Optional
Recognised for DORA Art. 26 evidence (regulatory) ISMS audit, ISO 27001, NIS-2
Cost from EUR 50,000 (red team service) €5,000-50,000

Process

The TIBER-DE process in three phases

TIBER-DE prescribes a three-part process. AWARE7 fulfils the RTT role (Red Team Test provider).

Authority TLPT authority with TIBER Cyber Team (TCT)

Preparation

Requests the TLPT, validates the control team and approves the scoping document

Testing

Approves the threat intelligence report and the red team test plan

Closure

Approves the summary report and issues the attestation

Financial entity Control team (White Team)

Preparation

Project charter, control team, scoping document, selection of providers

Testing

Selects the scenarios, steers the test, receives weekly progress reports

Closure

Blue team test report, summary report and remediation plan to the authority

TI provider Threat intelligence provider

Preparation

Selected and assessed by the control team

Testing

Threat scenarios and targeted threat intelligence report, then consultation on request

Closure

Exchange of feedback on the TLPT

AWARE7 Red team testers

Preparation

Selected and assessed by the control team

Testing

Red team test plan, active test on live systems, weekly reports

Closure

Red team test report within 4 weeks, replay and purple teaming with the blue team

Source: Commission Delegated Regulation (EU) 2025/1190, Art. 9 to 13, and the ECB TIBER-EU framework (2025).

01

Phase

Preparation Phase

Duration

up to 6 months

  1. A Scope definition jointly with white team and supervisory authority (BaFin / Deutsche Bundesbank TCT)
  2. B CIF assessment: 4-dimensional analysis of critical functions
  3. C Engagement of the independent TI provider (mandatory under RTS Art. 7)
  4. D The TCT (Bundesbank) provides the Generic Threat Landscape (GTL) as a baseline for the national threat landscape
  5. E Sign Rules of Engagement (RoE), create scope specification document (Annex II)
02

Phase

Testing Phase

Duration

≥ 12 weeks (RTS mandatory)

  1. A TI provider delivers targeted threat intelligence report (TTIR) based on dark web sources, OSINT and sector intelligence
  2. B AWARE7 red team draws up the red team test plan based on the TTIR: institution-specific, no generic attacks
  3. C Active attack simulation against live production systems (critical functions)
  4. D Documentation of attack paths and tactics, techniques and procedures (TTPs) with timestamps
  5. E At least weekly progress reports to control team and test managers (Art. 11(7)); the blue team is informed of the test only after the active phase (Art. 12(1))
03

Phase

Closure Phase

Duration

up to 10 weeks, then 8 weeks each

  1. A Purple team exercises (mandatory within 10 weeks after end of active phase): replaying attack chains jointly with SOC/blue team
  2. B Remediation planning and prioritised recommendations for action
  3. C Preparation of the summary report (Annex VII) and remediation plan in accordance with RTS 2025/1190
  4. D Submission to BaFin / Deutsche Bundesbank (TCT) - evidence of DORA Art. 26 fulfilment
  5. E Lessons-learned session with board and CISO

Scope Core

Critical or Important Functions (CIF) - the scope core of every TLPT

DORA Art. 3(22) defines which functions are to be classified as Critical or Important Functions (CIF). The CIF assessment is the basis of the entire scope definition and is carried out jointly with the white team and the authority during the preparation phase.

1. Financial stability

Functions whose failure would endanger the financial stability of the institution or the financial sector - e.g. liquidity management, capital calculation, supervisory reporting.

2. Systemic interconnection

Functions that, if compromised, would have systemic impact on other market participants - e.g. interbank clearing, TARGET2 interfaces, CCPs.

3. Replaceability

Functions that cannot be taken over by replacement systems within a reasonable timeframe - e.g. proprietary core banking systems without redundancy, critical trading platforms.

4. Regulatory continuity

Functions essential for supervisory reporting and compliance - e.g. reporting systems, AML/KYC infrastructure, MiFID reporting.

Typical CIF systems in practice:

Core banking system · Payment processing · TARGET2 connection · Online banking platform · Trading platform · Authentication infrastructure · Reporting system · AML/KYC engine · Clearing & Settlement · Mobile banking app

Why AWARE7

Why AWARE7 as RTT provider under RTS 2025/1190?

The DORA-TLPT-RTS sets clear requirements for red team test providers. AWARE7 meets all of them.

01

OSCP+-certified team

Multi-member offensive security team with OSCP+-certified consultants (OffSec) and multiple CVE authors (Adobe, WooCommerce, Pi-hole). Led by Vincent Heinen, M.Sc. IT Security (RUB), Head of Offensive Services. Meets RTS Art. 7: RT test leader ≥ 5 years, team size ≥ 3 persons.

02

Financial sector references (BaFin-regulated)

Engagements at BaFin-regulated institutions - including multi-year red team exercises for credit institutions and payment service providers under regulatory requirements. More than 500 completed penetration test projects.

03

ISO 27001 certified (since 2022)

AWARE7 GmbH is certified to ISO/IEC 27001:2022. Auditors, clients and authorities accept our ISMS certification as a quality credential. Important for RTT provider qualification.

04

Hiscox E&O insurance (mandatory evidence)

Professional indemnity insurance (Errors & Omissions) with Hiscox SA for €3,000,000 under the NET IT by Hiscox product. Mandatory evidence in the TIBER-DE procurement process - verifiable by authority and white team.

05

MITRE ATT&CK documentation

Complete documentation of all attack techniques under MITRE ATT&CK Enterprise: tactics, techniques, procedures (TTPs) with timestamps and artefacts. Red team test report (Annex V of the RTS) included. Purple team preparation from day one.

06

Data stored in Germany

AWARE7 is a German company based in Gelsenkirchen. All test data is processed exclusively on German servers. No data transfer to third countries - relevant for BSI-KRITIS, regulatory data protection requirements and banking secrecy.

Affected Institutions

Which institutions are affected by DORA TLPT?

RTS Art. 2 (EU 2025/1190) sets quantitative criteria for certain institution types as a starting point; even institutions that meet these criteria may be exempted if there is no cause for TLPT. Beyond these, the authority designates further institutions based on a risk analysis.

Designated by the authority under RTS Art. 2 (thresholds, exemptions possible):

G-SII / O-SII:
Credit institutions identified as G-SIIs or O-SIIs in accordance with Article 131 of Directive 2013/36/EU, or forming part of such a group (RTS Art. 2(2)(a)). The authority may also exempt listed institutions if there is no cause for TLPT.
Insurance undertakings:
Insurance and reinsurance undertakings that meet all base criteria of RTS Art. 2(2)(g) (including gross written premiums > EUR 1,500,000,000) and additionally exceed at least one of the extended thresholds.
Payment service providers:
Payment institutions above EUR 150 billion in payment transactions (RTS Art. 2(2)(b)) and e-money institutions above EUR 150 billion in payment transactions or EUR 40 billion in outstanding e-money (point (c)), in each of the two preceding calendar years.

Systemically important banks

G-SII/O-SII credit institutions per Art. 131 CRD IV; further institutions on authority risk assessment

Insurance undertakings

Insurance and reinsurers: GWP > EUR 1,500,000,000 plus additional conditions per RTS Art. 2(2)(g)

Payment service providers

Payment institutions > EUR 150bn transactions; e-money institutions > EUR 150bn transactions or > EUR 40bn outstanding e-money

Central counterparties

CCPs, central securities depositories (CSDs), trading venues

On regulatory direction

Smaller institutions may be included by regulatory order

Exempt under DORA Art. 26(1) are microenterprises and the institutions referred to in Art. 16(1) first subparagraph of DORA (including small and non-interconnected investment firms and certain exempted payment and e-money institutions). The competent authority makes the designation.

Budget

Costs and budget planning for DORA TLPT

TLPT engagements are substantially more extensive than conventional penetration tests - the costs reflect duration, team size and regulatory overhead.

01

Component

RTT provider (AWARE7)

Range

from EUR 50,000

Scope complexity, number of CIF systems, duration of active phase (min. 12 weeks), team size (min. 3 persons per RTS)

02

Component

TI provider (separate)

Range

€30,000 - €80,000

Targeted threat intelligence report (TTIR): dark web research, OSINT, malware analysis, sector intelligence. The TI provider must not belong to the financial entity; its staff are separated from the red team.

03

Component

Internal coordination costs

Range

€30,000 - €180,000

White team effort, legal/compliance, external legal advice, authority coordination, CISO time, remediation implementation

Σ

AWARE7 red team services: from EUR 50,000

The TI provider (typically EUR 30,000-80,000) and internal coordination costs are additional. AWARE7 provides a binding fixed-price quote: no hourly rates, no retrospective claims. Quote within 48 hours of initial consultation.

International

TIBER-DE in international comparison

TIBER-DE is part of a global ecosystem of regulatory red team frameworks. All follow the three-phase approach and mandate genuine threat intelligence.

Swipe table horizontally

Framework Country / Region Authority Since Basis
TIBER-DE Germany Deutsche Bundesbank (TCT) 2019 TIBER-EU / DORA
CBEST United Kingdom Bank of England 2014 Standalone
TIBER-EU EU (cross-border) ECB 2018 Reference framework
TIBER-NL Netherlands DNB 2016 TIBER-EU
TIBER-SE Sweden Riksbank 2019 TIBER-EU
TIBER-BE Belgium NBB 2018 TIBER-EU
iCAST Hong Kong HKMA 2016 Standalone
CORIE Australia CFR 2020 Standalone

The TLPT attestation under DORA Art. 26(7) enables mutual recognition of cross-border tests for financial entities providing services in more than one EU member state, including through branches (RTS Art. 16(1)).

FAQ

Frequently asked questions about DORA TLPT and TIBER-DE

Threat-Led Penetration Testing (TLPT) is a testing obligation imposed on a risk basis under the DORA Regulation (EU) 2022/2554, Art. 26: the competent authority identifies which financial entities must perform TLPT. Unlike a classical penetration test, TLPT is based on genuine threat intelligence (Targeted Threat Intelligence) about current adversaries specifically targeting the institution or the sector. The red team simulates these real-world adversaries against live production systems, including critical functions such as payment processing or core banking systems. The entire process is under regulatory oversight and must be reported to the competent authority (BaFin / Deutsche Bundesbank).
Art. 26 DORA obliges those financial entities that are identified by the competent authority (in Germany: BaFin or Deutsche Bundesbank) on the basis of a risk assessment. The DORA-TLPT-RTS (Regulation EU 2025/1190, in force from 8 July 2025) specifies thresholds: credit institutions identified as G-SIIs or O-SIIs in accordance with Article 131 of Directive 2013/36/EU, or forming part of such a group (RTS Art. 2(2)(a)), payment institutions and e-money institutions exceeding EUR 150 billion in total payment transactions in each of the two preceding calendar years (RTS Art. 2(2)(b),(c)), and insurance and reinsurance undertakings meeting all base criteria under RTS Art. 2(2)(g), including gross written premiums exceeding EUR 1,500,000,000, plus at least one additional extended threshold. Even institutions meeting these criteria may be exempted if there is no cause for TLPT. Affected financial entities must conduct TLPT at least every three years.
A conventional penetration test examines defined systems for known vulnerabilities: the scope is narrow, the blue team is usually informed, the methodology is standardised and the duration is 3-10 days. TLPT goes fundamentally further: (1) it is based on a targeted threat intelligence report (TTIR) from a threat intelligence provider independent of the financial entity; (2) testing is performed on live production systems (DORA Art. 26(2)); (3) the blue team (SOC) does not know that a test is taking place; (4) the process consists of sequential mandatory phases: scoping document within 6 months of the notification, active test phase of at least 12 weeks, purple teaming within 10 weeks of test end; (5) scope, methodology and results are coordinated with BaFin / Deutsche Bundesbank.
TIBER-DE (Threat Intelligence-Based Ethical Red-Teaming) is the Deutsche Bundesbank's framework for regulatory-recognised red team tests in the German financial sector. It was introduced in 2019 and updated to version 4.0 in July 2025 to align with DORA TLPT requirements. Since then, the TIBER-EU framework applies directly to TIBER-DE tests. TIBER-DE is the methodology applied in Germany for fulfilling the DORA Art. 26 obligation. Engagements under TIBER-DE are coordinated by the TIBER Cyber Team (TCT) of the Bundesbank and recognised by the supervisory authority.
A TIBER-DE engagement is structured in three mandatory phases: (1) Preparation Phase (deadline for scope specification document: 6 months from notification): TLPT initiation information including the project charter submitted to test managers within 3 months (RTS Art. 9(2)), control team set up, TI provider and RTT provider selected and assessed, scope specification document (Annex II of the RTS) submitted to test managers and approved by the TLPT authority. (2) Testing Phase (minimum duration 12 weeks): TI provider delivers the targeted threat intelligence report (TTIR), AWARE7 red team creates the red team test plan based on the TTIR and commences active attack simulation against live production systems, documentation of attack paths and TTPs with timestamps. (3) Closure Phase: purple team exercises mandatory within 10 weeks after end of active phase, red team test report within 4 weeks, blue team test report within 10 weeks, then summary report (Annex VII of the RTS) and remediation plan each within 8 weeks of the TLPT authority confirming both reports are complete (RTS Art. 12(7), Art. 13); TLPT authority issues attestation (DORA Art. 26(7)).
There is no formal state accreditation for TIBER-DE RTT providers. The selection lies with the financial entity; the control team assesses and documents compliance with RTS Art. 7(1) and submits the corresponding evidence to the TLPT authority. Under RTS Art. 7, the red team must consist of at least a manager with at least 5 years of experience in penetration testing and red team testing, plus at least two additional testers each with at least 2 years of experience. External testers provide a combined total of at least 5 reference engagements (RTS Art. 7(1)(d)). Further requirements: certifications appropriate by recognised market standards (RTS Art. 7(1)(a)), adequate professional indemnity insurance and full independence from the entity being tested.
AWARE7 meets all RTS requirements for RTT providers: (1) Offensive security team with 11 consultants, including 4 × OSCP+ (OffSec), multiple CVE authors (Adobe, WooCommerce, Pi-hole); (2) ISO/IEC 27001:2022 certification; (3) professional indemnity insurance with Hiscox (€3m E&O, NET IT); (4) demonstrated red team experience at BaFin-regulated financial institutions (credit institutions, insurers, payment service providers); (5) application of the TIBER-DE methodology in past engagements under the leadership of Vincent Heinen (Head of Offensive Services, M.Sc. IT Security, RUB); (6) MITRE ATT&CK documentation for every engagement; (7) data stored in Germany.
Critical or Important Functions (CIF) are the core of every TLPT scope. Under DORA Art. 3(22) and the RTS, functions are classified as critical or important if: (1) their disruption would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities; (2) their compromise would have systemic impact on other market participants; (3) they could not be taken over by replacement systems within a reasonable time; or (4) they are essential for regulatory reporting. Typical CIF: core banking system, payment processing, authentication infrastructure, operational trading platforms, supervisory reporting. The CIF assessment is carried out jointly with the white team and the authority during the preparation phase.
TLPT under DORA targets the critical functions (CIF) of the institution: the systems that would have systemic consequences if disrupted or compromised. Scope typically covers core banking systems, payment infrastructure, authentication systems and operational databases. The precise scope definition takes place in the preparation phase together with the control team (white team) and the supervisory authority, documented in the scope specification document (Annex II of the RTS). Testing is exclusively against live production systems: no staging, no test environment.
TIBER-DE-compliant engagements start at AWARE7 as RTT provider from EUR 50,000 (net). The price depends on scope complexity, duration of the active phase (at least 12 weeks) and team size. The separately commissioned costs of the TI provider for the targeted threat intelligence report (typically EUR 30,000-80,000) are additional. AWARE7 provides a binding fixed-price quote: no hourly rates, no retrospective claims.
The white team is the coordination unit of the institution that has the full overview of the engagement. It typically consists of senior management/board, CISO and optionally legal/compliance. The white team acts as the link between the RTT provider, TI-provider and supervisory authority. It approves the scope, knows the test period and makes emergency decisions. The operational IT/security team (blue team/SOC) is deliberately kept uninformed to ensure realistic detection conditions.
Under DORA Art. 26(8) and RTS Art. 15, financial entities may use internal testers under certain conditions, provided they establish a policy for the use of internal testers and ensure sufficient resources and capabilities (RTS Art. 15(1)). Credit institutions classified as significant under Art. 6(4) of Regulation (EU) No 1024/2013 must always engage external RTT providers. For other financial entities: every third TLPT must use external testers. When approving internal testers, the TLPT authority considers the requirements of RTS Art. 7(1) (RTS Art. 15(2)).
The purple team phase is a mandatory component of every TLPT under the RTS and TIBER-DE and must take place within 10 weeks of the end of the active test phase. In the purple team exercise, attack chains are replayed jointly by the red team (AWARE7) and the blue team (SOC of the institution): the red team shows how an attack played out, the blue team learns how it should have been detected and stopped. The objective is knowledge transfer, detection improvement and preparation of the remediation plan. Under RTS Art. 12(5), the purple team exercise is a mandatory part of the closure phase.
Yes. TIBER-DE is part of a global ecosystem of comparable frameworks: CBEST (UK, since 2014, Bank of England), TIBER-NL (Netherlands, DNB), TIBER-SE (Sweden, Riksbank), TIBER-BE (Belgium, NBB), TIBER-DK (Denmark), iCAST (Hong Kong, HKMA), CORIE (Australia, Council of Financial Regulators). All follow the three-phase approach (Preparation / Testing / Closure) and mandate genuine threat intelligence. RTS 2025/1190 was drafted in line with the TIBER-EU framework (ECB); DORA and the RTS are legally binding, while TIBER-EU remains a voluntary methodological reference framework. A TIBER-DE completion can in certain constellations be mutually recognised across multiple jurisdictions.
After notification by BaFin / Deutsche Bundesbank, the following binding deadlines apply: (1) 3 months: TLPT initiation information, including the project charter and contact details of the control team lead, must be submitted to the test managers (RTS Art. 9(2)). (2) 6 months: The scope specification document (Annex II of the RTS) must be submitted to the test managers (RTS Art. 9(6)). (3) Active test phase: minimum duration 12 weeks. (4) Purple team exercises: mandatory, within 10 weeks after end of active phase (RTS Art. 12(5)). (5) Summary report (Annex VII of the RTS) and remediation plan: each submitted to the TLPT authority within 8 weeks after the authority confirms the test reports are complete (RTS Art. 12(7), Art. 13(1)). The TLPT authority then issues the attestation (DORA Art. 26(7)).
Commission Delegated Regulation (EU) 2025/1190 (DORA-TLPT-RTS) was adopted on 13 February 2025, published in the Official Journal of the EU on 18 June 2025, and entered into force on 8 July 2025. It contains 17 articles and 8 annexes and specifies the DORA Art. 26 requirements: (1) Article 2: Criteria and thresholds for identifying financial entities required to perform TLPT. (2) Article 5: Risk management in the context of TLPT. (3) Article 7: Qualification requirements for RTT and TI providers. (4) Articles 8-12: Testing phases (pooled tests, preparation phase, threat intelligence analysis, red team test, closure phase). (5) Articles 13-15: Remediation plan, attestation and use of internal testers. (6) Annexes I-VIII: Mandatory templates including project charter, scope specification document, targeted threat intelligence report, red team test plan, red team test report, blue team test report, summary report (Annex VII) and attestation.

Your contact for DORA TLPT

Vincent Heinen
Vincent Heinen

Head of Offensive Services

E-Mail
PGP 1DDAA57F2B972787

M.Sc. in IT Security with more than 5 years of experience in offensive security analysis. Leads the delivery of penetration tests, specializing in web applications, network infrastructure, reverse engineering and hardware security. Responsible for several responsible disclosures.

Responsible Disclosures: CVE-2023-0865 CVE-2025-43579 CVE-2025-53533
OSCP+ OSCP OSWP OSWA
View full profile

Related services

Red Teaming

APT simulation for all industries - technical, social engineering, physical.

DORA Compliance Consulting

Full DORA implementation: ICT risk management, incident reporting, Art. 30.

Penetration Testing

Technical security assessments for web, network, cloud and mobile.

Fixed-price quote in 48h

Planning a DORA TLPT?

We discuss scope, CIF assessment, timeline and authority coordination - free and non-binding. You receive a binding fixed-price quote within 48 hours.

Schedule initial consultation +49 209 8830 6764

Rufen Sie uns an

Mo-Fr, 8:00-17:00 Uhr - persönlich und unverbindlich.

0209 8830 6764
Jetzt anrufen