On this page
Working out your DORA testing plan? We run the yearly penetration testing every DORA entity needs and the red team exercises that prepare you for TLPT.
DORA has applied since 17 January 2025, and the most common question we get from EU banks, payment firms, insurers and investment firms is some version of: “Do we need TLPT, or is our annual pentest enough?” The honest answer for most firms is that they need a solid yearly testing programme, and a smaller group needs TLPT on top of it.
Two levels of testing under DORA
| Resilience testing programme (Arts 24 and 25) | Threat-led penetration testing (Arts 26 and 27) | |
|---|---|---|
| Who | All in-scope financial entities except microenterprises | Entities identified by their competent authority using the RTS criteria |
| How often | ICT systems supporting critical or important functions tested at least yearly | At least every three years |
| What | A risk-based mix: vulnerability scans, network security assessments, source code reviews, scenario-based tests, performance and end-to-end tests, penetration tests | An intelligence-led red team test of several or all critical or important functions on live production systems |
| Who tests | Independent internal or external parties | External testers, or internal testers under conditions, with external testers every third test |
| Supervisor involvement | Results feed your ICT risk framework | TLPT authority oversees the test and issues an attestation |
The yearly testing programme every DORA entity needs
Article 24 requires a sound and comprehensive digital operational resilience testing programme as part of your ICT risk management framework. Testing is risk-based and proportionate, carried out by independent parties (internal or external), and any issues found must be classified, prioritised and fixed. Systems and applications that support critical or important functions must be tested at least yearly.
Article 25 lists the kinds of tests the programme can include: vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
In practice, a defensible yearly programme for a mid-sized firm looks like this:
- An inventory of critical or important functions and the ICT systems that support them
- External and internal penetration tests of those systems, at least yearly
- Application and API testing for customer-facing and partner-facing services
- Cloud configuration review and testing for workloads that support critical functions
- Regular vulnerability scanning and source code review where it is feasible
- Scenario-based exercises, such as ransomware or third-party outage tabletops
- A remediation tracker that classifies, prioritises and closes findings, with retests
What TLPT involves
TLPT is DORA’s version of TIBER-EU. A control team inside the financial entity knows about the test; the rest of the organisation, including the defenders, does not. Threat intelligence identifies realistic attackers and their methods, and red team testers then try to compromise the critical functions in scope on live production systems.
The RTS on TLPT, Commission Delegated Regulation (EU) 2025/1190, was adopted on 13 February 2025, published in the Official Journal on 18 June 2025 and in force since 8 July 2025. It sets out:
Preparation
The TLPT authority notifies the entity. The control team is set up, initiation documents are submitted within three months and the scope of critical or important functions is specified within six months.
Threat intelligence
A threat intelligence provider builds a targeted report on the entity and the threat actors most likely to attack it, which becomes the basis for attack scenarios.
Red team testing
Testers execute the scenarios against live production systems. The active red team phase lasts at least 12 weeks.
Closure
Reports, a replay and purple team learning with the defenders, a remediation plan, and an attestation from the TLPT authority that the test met the requirements.
Limited purple teaming during the test is allowed only as a last resort, in exceptional circumstances, with prior validation from the TLPT authority.
Who has to do TLPT
The RTS identifies the entities that are generally required to perform TLPT. They include global and other systemically important credit institutions, large payment and e-money institutions above transaction or e-money thresholds, central counterparties and central securities depositories, significant trading venues with electronic trading systems, significant insurance and reinsurance undertakings and some crypto-asset service providers. Authorities can also add or exclude entities based on their ICT risk profile and systemic importance. If you have not been notified, you are not yet in a TLPT cycle, but it is worth knowing whether you are close to the thresholds.
Who can test
Article 27 sets requirements for testers: the highest suitability and reputability, specific expertise in threat intelligence, penetration testing and red teaming, certification by an accreditation body or adherence to formal codes of conduct, independent assurance or an audit report on their risk management, and professional indemnity insurance. Internal testers can be used under conditions, but external testers are required for every third test, and credit institutions classified as significant under the ECB’s Single Supervisory Mechanism must only use external testers.
How to tell what you need
- Check whether you are in DORA scope. Most EU financial entities are, from banks and payment firms to insurers, investment firms and crypto-asset service providers.
- Check whether you are a microenterprise. Microenterprises are exempt from the yearly testing requirement in Article 24(6) and follow a lighter regime.
- Map critical or important functions. These drive both the yearly testing scope and any TLPT scope.
- Check the TLPT criteria. Compare your size, systemic role and transaction volumes with the RTS criteria, and note whether your authority has contacted you.
- Build the yearly programme regardless. Even TLPT entities need it, and it is the best preparation for a TLPT.
- Rehearse with a red team. A red team exercise before your first TLPT shows where detection and response are weak while the stakes are lower.
If your group also falls under NIS2 or operates outside the EU, see which compliance frameworks require penetration testing to line up the overlapping requirements.
Penetration testing vs red teaming vs TLPT
A penetration test finds as many exploitable weaknesses as possible in a defined scope, usually with the defenders aware. A red team pursues an objective covertly to test detection and response. TLPT is a red team exercise under a regulatory framework, with threat intelligence, supervisor oversight, a minimum duration and an attestation. Our article on red team vs penetration testing explains the difference in more depth.
How Summit helps DORA entities
Summit runs the yearly testing that every DORA entity needs: network penetration testing, web application and API testing, and cloud security assessments of the systems that support critical or important functions, with findings classified, prioritised and retested. Our red team operations use the same intelligence-led approach as TLPT, which makes them a strong rehearsal before a regulated test. Our DORA and NIS2 compliance page covers the wider requirements.
Build a DORA testing plan you can defend
Tell us your critical or important functions and where you are with TLPT. We will design the yearly testing programme and a red team rehearsal around them. Get a quote.
Related reading: Red team vs penetration testing · Which compliance frameworks require penetration testing? · Cloud penetration testing on AWS, Azure and GCP
Frequently asked questions
What is TLPT under DORA?
Threat-led penetration testing: a controlled red team exercise that mimics the tactics of real threat actors against an entity's live production systems supporting critical or important functions. It is required under Article 26 of DORA for financial entities identified by their competent authority, and follows the TIBER-EU approach.
How often is TLPT required?
At least every three years for the financial entities required to perform it. The competent authority can ask for more or less frequent testing depending on the entity's risk profile.
Do all DORA entities need TLPT?
No. Every financial entity in scope, other than microenterprises, needs a digital operational resilience testing programme, including yearly tests of the ICT systems that support critical or important functions. TLPT applies only to entities that meet the criteria in the RTS and are notified by their TLPT authority.
How long is the active red team phase in a TLPT?
At least 12 weeks under the RTS on TLPT, Delegated Regulation (EU) 2025/1190. Time spent in a limited purple teaming exercise, allowed only in exceptional circumstances with the authority's validation, counts towards the 12 weeks.
Can internal testers perform TLPT?
Yes, subject to conditions, but financial entities must contract external testers for every third test. Credit institutions classified as significant under the ECB's Single Supervisory Mechanism must use only external testers.
Does a regular penetration test satisfy DORA?
It satisfies part of the yearly testing programme under Articles 24 and 25, which explicitly lists penetration testing alongside vulnerability scans, source code reviews and scenario-based tests. It does not replace TLPT for entities required to perform it.
