Europe · DORA · TIBER-EU · PASSI · BSI · NIS2
DORA TLPT, TIBER-EU, PASSI and BSI testing, run end to end by Sumrite.
European financial entities, public bodies and essential operators face testing rules that name qualified providers. Sumrite runs the engagement and routes the qualified step through its European partners.
Under DORA, designated EU financial entities must run threat-led penetration testing (TLPT) at least every three years, following the TIBER-EU framework, with testers that meet the regulation’s requirements. France’s ANSSI qualifies security audit providers under PASSI, and Germany’s BSI certifies IT security service providers for penetration testing. Sumrite runs these engagements end to end and routes the qualified step through its partners in Europe.
Who needs it
| Who | When it applies |
|---|---|
| Banks, insurers and payment firms | DORA TLPT for entities designated by their authority, and regular testing for the rest |
| French public bodies and operators | PASSI qualified audits where ANSSI rules or contracts require them |
| German public sector and KRITIS | BSI certified penetration testing providers where required |
| NIS2 essential and important entities | Regular, documented security testing under national NIS2 laws |
How Sumrite delivers it
Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.
- Confirm the regime. DORA TLPT, TIBER-EU, PASSI, BSI or NIS2 evidence, and who your authority or buyer accepts.
- Threat intelligence and scope. For TLPT, a threat intelligence phase sets realistic attack scenarios on critical functions.
- Testing by qualified testers. Carried out with the partner that holds the required qualification, coordinated by Sumrite.
- Closure and remediation. Reports, purple-team replay where required, remediation plans and retest.
Frequently asked questions
What is DORA TLPT?
Threat-led penetration testing under the Digital Operational Resilience Act: an intelligence-led red team test of live production systems behind critical functions, required at least every three years for designated financial entities.
What is a PASSI audit?
A security audit by a provider qualified by ANSSI, France’s national cybersecurity agency, under the PASSI scheme.
Can Sumrite deliver PASSI or BSI certified testing?
Yes, through European partners that hold those qualifications, with Sumrite running the engagement end to end.
Accredited testing
Need a test a regulator or buyer will accept?
Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.