Requirements3 min read
TLPT vs penetration testing: what changes under DORA?
Why a conventional penetration test does not automatically meet the requirements of a DORA threat-led exercise.
Read the perspectiveINSIGHTS & GUIDES
Clarity before you begin.
Practical reading for the people who scope, procure and govern a DORA TLPT.
8 guides
Planning3 min read
How to scope a DORA TLPT around critical functions
Start with the function, trace the dependencies and make the boundary of the test explicit.
Read the perspectivePlanning3 min read
How long does a DORA TLPT take?
Understand the 12-week active-testing minimum and the preparation and closure work that sit around it.
Read the perspective
Requirements3 min read
Article 27: what to verify in a TLPT provider
Translate DORA’s tester requirements into evidence requests for your provider and the team that will actually deliver the test.
Read the perspectiveRequirements3 min read
TIBER-EU and DORA: how the pieces fit
Separate legal requirements from operational guidance, and understand why both matter to a threat-led engagement.
Read the perspective
Delivery3 min read
The control team: governing a safe, useful TLPT
How a restricted control team keeps the exercise authorised, coordinated and focused on learning.
Read the perspectivePlanning3 min read
ICT third parties in a DORA TLPT
Why provider participation, shared services and testing permissions belong in the scope from the beginning.
Read the perspectiveDelivery3 min read
From TLPT findings to accountable remediation
Make closure useful by connecting the attack narrative, defensive observations and practical improvement decisions.
Read the perspectiveNo guides match this search. Try “scope”, “testing” or choose All topics.
LET’S START A CONVERSATION
Define the scope.
Take the next step.
Your critical functions. Your authority’s requirements. A clear starting point for your TLPT engagement.
Discuss your TLPT