DORA Article 27: What Evidence Must TLPT Testers Provide?

The decision this guide helps you make

Evaluate the people and delivery arrangements against Article 27, not just the supplier presentation. Request evidence for suitability, relevant capability, ethical frameworks, independence and risk assurance. Reassess the evidence if the team or subcontracting arrangement changes.

A methodology description is not due diligence

DORA Article 27 sets requirements for the testers used to conduct TLPT. Procurement should obtain evidence against those requirements and evaluate the actual delivery arrangements. A badge, a broad statement of experience or a reference to TIBER-EU is not a substitute.

The assessment needs to cover the organisation and the named people proposed for the work. Ensure the evidence remains relevant if the provider changes its team or introduces a subcontractor.

Suitability and specific expertise

Article 27 addresses suitability and reputation, technical and organisational capability, and specific expertise in threat intelligence, penetration testing and red-team testing. Ask how that expertise maps to the proposed roles and scenarios.

Relevant experience should be described at an appropriate level without breaching another client’s confidentiality. A procurement team can agree a secure channel for references, supporting records and team information rather than relying entirely on public marketing pages.

Certification and ethical frameworks

The legal provision refers to certification by an accreditation body in a Member State or adherence to formal codes of conduct or ethical frameworks. Do not reduce this wording to a claim that one particular commercial certificate is universally mandatory or sufficient.

Ask which basis the provider relies on, what it covers and how it applies to the work. Personal qualifications can be relevant evidence of skills, but they do not automatically satisfy every organisational requirement.

Risk assurance and insurance

Independent assurance or audit evidence must address the sound management of risks associated with TLPT, including protection of confidential information and redress for business risks. The financial entity should understand the scope, date and relevance of the assurance provided.

Professional indemnity insurance also matters. Review whether the proposed activities, parties and risks fall within the coverage. The existence of a policy alone does not establish that an engagement is appropriately covered.

Internal testers require a separate analysis

Internal testing is subject to conditions, including relevant authority approval, independence and safeguards under DORA and the RTS. Significant credit institutions must use external testers under Article 26. The choice cannot be decided solely by resource availability.

For other entities using internal testers under permitted arrangements, the applicable requirements include periodic use of external testers. Review the precise legal conditions and authority expectations for the entity before selecting the model.

Build a traceable procurement decision

Record the requirement, the evidence requested, the assessment, any gap and the decision owner. Make unresolved conditions explicit in procurement governance. Contractual commitments, named resources and evidence-handling arrangements should match what was evaluated.

Make the response specific to the proposed engagement

Ask the provider to identify the proposed delivery roles, relevant experience, supervision arrangements and evidence supporting the requirements it claims to meet. Clarify whether named people are committed or only examples of available staff. Record how replacements would be assessed and approved. The financial entity needs an intelligible basis for its decision, not an unqualified assurance that the supplier is “DORA compliant”.

For comparison discipline, the bank pentest procurement guide shows how to normalise scope, access assumptions and evidence expectations. Use that structure alongside the specific TLPT requirements, rather than substituting an ordinary technical-testing questionnaire for the Article 27 review.

Examine how the evidence will be handled

Discuss the handling of sensitive threat intelligence, operational observations, credentials and report material throughout the engagement. Identify access restrictions, storage and transfer arrangements, retention, deletion and subcontractor participation. Ask how a material incident or unexpected operational effect would be escalated. These questions make the proposed safeguards concrete and help the entity understand its own responsibilities and dependencies.

Inspect a fictional or properly sanitised report and trace one finding from starting position to evidence, impact and proposed treatment. The fintech report and retesting guide provides useful evidence-quality questions. Reporting quality alone does not establish tester eligibility or fulfil every TLPT obligation; it is one part of a documented evaluation that must address the actual requirements and applicable authority arrangements.

Continue your preparation

• The procurement checklist
• DORA TLPT requirements