Confirm the mandate
Formal TLPT under Article 26 is not a synonym for an annual pentest. Establish whether the entity has been identified for testing and how its responsible authority expects the process to run. A provider can help prepare a scope but cannot decide on behalf of the authority that the entity is in or out.
Describe the function
Consider an illustrative payments function: customer instructions are authenticated, approved and transmitted for settlement. Write down which outcome must remain trustworthy. A list of IP addresses does not tell a threat intelligence provider whether disruption, unauthorised approval or loss of transaction integrity matters most.
Map the supporting chain
Follow one representative transaction across internal and external dependencies. Name system owners, administrative access paths and significant manual interventions. Mark where evidence is missing instead of filling gaps with assumptions about a supplier's platform.
Identify supplier constraints
Financial entities remain responsible for arranging appropriate third-party participation where applicable. Do not treat a cloud subscription as permission to test a provider's infrastructure. Raise constraints with the control team and relevant authority early, including whether an alternative arrangement needs consideration.
Define controlled proof
For an approval workflow, ask what evidence could demonstrate a compromised control without moving real funds. The answer belongs in the authorised test design, not a sales quotation. Identify people empowered to stop the exercise and agree how the control team can reach them without compromising confidentiality.
Separate price assumptions
Ask bidders to state what they assumed about intelligence work, red-team effort, third-party coordination and closure. Two bids for the same function can differ because one assumes readily available supplier permissions and the other includes preparation workshops. Resolve those assumptions before comparing totals.
Prepare the authority discussion
Bring a short functional map, key dependencies, ownership and material unknowns. Distinguish the institution's proposed scope from a validated scope. Ask a prospective provider to explain how its preparation work supports the Article 26 process and the detailed requirements of Delegated Regulation 2025/1190.
A payments boundary that changes the proposal
Suppose a bank proposes testing its customer portal. The critical function, however, depends on instruction processing, a privileged approval service and a third-party gateway. Ask each owner which dependency could affect the function and which evidence supports that view. The control team can then discuss a reasoned scope with its authority rather than equating a single internet-facing application with the whole function.
| Dependency | Key uncertainty | Preparation action |
|---|---|---|
| Customer channel | Which instructions reach approval? | Trace one synthetic transaction. |
| Approval service | Who can change the decision logic? | Identify authorised owners and safety limits. |
| Third-party gateway | What participation is permitted? | Resolve contractual and authority questions. |
Primary texts: DORA, Articles 26 and 27 and Commission Delegated Regulation (EU) 2025/1190.
Published by Atlant Security. Sources, editorial policy and corrections.
