DORA Article 27: The Evidence to Request Before Hiring TLPT Testers

Article 27 procurement: verify the team behind the proposal

Selecting a TLPT provider is an evidence decision, not a logo comparison. The financial institution needs to understand who will perform the work, what experience they bring, how they manage the risks of a controlled production exercise and how sensitive results will be protected. A polished proposal can answer none of those questions. The useful procurement outcome is a defensible record connecting each relevant requirement to evidence, a reviewer and a decision.

This guide turns DORA Article 27 into a practical procurement workflow without presenting a checklist as regulatory approval. It focuses on how to request, inspect and preserve evidence. Read it alongside our overview of Article 27 tester requirements and the current detailed RTS. The examples are fictional evaluation situations, not statements about the credentials of Atlant Security or any other provider.

For a DORA TLPT engagement, the selected delivery team matters as much as the contracting organisation. A company may have strong corporate references while assigning people with different experience to your exercise. Procurement should establish the proposed roster, responsibilities, availability and substitution process before comparing price. Otherwise the evaluation may approve one team while the contract permits another to arrive.

Build an authoritative requirements register first

DORA Article 27 addresses suitability, capability, expertise, professional frameworks, independent assurance and relevant indemnity insurance. It also sets conditions for internal testers and requirements for handling results. Those obligations should be assessed together with the detailed provider-selection provisions in Delegated Regulation (EU) 2025/1190, including the applicable personnel, reference and separation criteria.

Do not reduce the register to a single “DORA certified” checkbox. Ask the legal and risk owners to identify the exact provisions that apply to the proposed operating model. Separate external testers, threat intelligence providers and any proposed internal testing role. Record authority-specific expectations and contractual requirements in their own columns. This avoids treating a useful commercial preference as a statutory obligation or overlooking a mandatory condition because it is absent from a vendor template.

Keep the authoritative wording in a controlled reference register and use plain language in the working questionnaire. Each question should identify the decision it supports. For example, a request for a named team roster supports assessment of the actual assigned capability; a request for an information-handling procedure supports assessment of how results will be managed. If a question has no decision attached, reconsider whether it belongs in the initial procurement pack.

Use an evidence matrix that exposes gaps

Create one row per requirement or closely related evidence question. Include the evidence requested, the item received, its date and scope, the reviewer, the outcome and any condition. Avoid a scoring system that allows a high marketing score to compensate for a missing mandatory requirement. First establish whether essential conditions are satisfied; only then compare the relative merits of acceptable proposals.

Use explicit statuses such as verified, partially evidenced, clarification required and not applicable with rationale. “Yes” is not a useful evidence status when it only means the provider ticked a box. Preserve the difference between a declaration and an independently reviewed document. Both may have a place, but they support different levels of confidence and should not become indistinguishable in the final approval paper.

Evaluate the people who will actually perform the work

Ask for a roster that identifies the engagement lead, threat intelligence roles, red team roles, specialist support and escalation contacts. Record which people are committed and which are provisional. A proposed person who is not available during the planned window does not provide the same assurance as a confirmed assignment. Ask how holiday, illness or an overlapping incident-response engagement would affect continuity.

Review experience in relation to your scoped functions and technologies. A strong web application tester may not have the same experience as someone who has managed a covert, multi-party production exercise. Equally, a long list of red team engagements does not establish familiarity with every specialist banking platform. Identify where the team has direct experience, where it relies on transferable skills and where specialist support is proposed.

Treat credentials as evidence of a defined achievement rather than a substitute for the whole capability review. Check the issuing body, the credential’s scope and any relevant validity information. Where a provider relies on a professional code or ethical framework, ask which framework applies and how adherence is operationalised. Avoid inventing a universal certification requirement beyond the applicable legal wording and authority process.

Include a short technical discussion with the proposed lead. Use a fictional scoping problem: a critical function depends on an outsourced identity service and a fragile operational component. Ask how the lead would identify dependencies, propose safety boundaries and record uncertainty. The purpose is to assess judgment and communication, not to extract a free attack plan or encourage unsafe claims of guaranteed access.

Verify references without demanding another customer’s secrets

Request references through a controlled process that respects the referenced customer’s confidentiality. Ask what kind of assignment was performed, when it occurred, which proposed personnel participated and what their responsibilities were. A corporate case study may establish that the firm has done relevant work, but it may not establish that the named team has the experience claimed for this procurement.

Where direct reference contact is permitted, prepare a consistent set of questions. Did the provider communicate changes promptly? Were safety boundaries respected? Were reports traceable and useful for remediation? How did the team handle blocked paths or uncertain evidence? Did the delivered work match the agreed scope? These questions provide more useful procurement evidence than asking whether the customer was generally satisfied.

Do not ask for live customer vulnerabilities, credentials, operational details or unredacted reports. A redacted structure or fictional sample can demonstrate reporting quality without exposing another institution. If the provider cannot disclose a particular reference, record the reason and assess the acceptable alternative through the appropriate review route. Do not silently treat an unavailable reference as either proof of failure or proof of compliance.

Maintain a reference summary with the reviewer, date, permission basis and conclusion. Keep personal contact information restricted. The procurement decision should be supported by the relevant facts without circulating reference contacts throughout the organisation. If a reference changes the assessment materially, explain how it affected the decision rather than leaving the evidence buried in an email chain.

Map conflicts and operational separation

Ask the provider to disclose relationships that could affect the independence or secrecy of the exercise. Consider existing defensive services, consulting assignments, supplier relationships and the use of the same organisation for multiple TLPT workstreams. The relevant question is not simply whether a relationship exists, but how the applicable rules and the specific risk are addressed. Record the proposed safeguards and the reviewer’s conclusion.

Make separation concrete. Which staff can access the intelligence report? Which staff can access red team operational information? Who already supports the defensive environment? How are shared ticketing systems, document repositories and management reporting controlled? A statement that teams are “separate” is incomplete if both teams can see the same engagement workspace or if routine account management exposes the testing schedule.

Test the information path on paper before execution. Imagine a routine support ticket mentioning an unfamiliar tool or a scheduled access request. Could it reveal the exercise to people who should not know? Could a shared manager inadvertently influence defensive behaviour? The control team should review these routes with the provider and agree handling arrangements consistent with the applicable process.

Keep independence decisions revisitable. A provider may win a new defensive contract, replace a team member or introduce a subcontractor after selection. Require disclosure of changes that affect the assessed position. The approval record should identify the assumptions on which the original decision depended so that a later change triggers a focused reassessment rather than an argument about what procurement intended.

Read the scope of independent assurance

An assurance document is useful only if its scope addresses the risks being evaluated. Check which legal entity, services, locations and period it covers. Identify exclusions and qualifications. A general organisational certificate or security overview may provide useful background but should not automatically be treated as the specific assurance required for the proposed TLPT activities. Ask the responsible reviewer to explain the connection.

Inspect the operational procedures behind the assurance. How are testing tools approved? How are dangerous actions constrained? How are unexpected effects escalated? How are sensitive findings stored and transmitted? What happens when a provider workstation is lost or an account is suspected of compromise? A procurement review should establish that these questions have workable answers before the team reaches production systems.

Ask for evidence that procedures are used, while keeping the request proportionate. A redacted exercise record, change-control example or restoration checklist may help demonstrate operation. Do not demand broad internal records unrelated to the engagement. Focus on the risks that matter to your institution and document any reliance on declarations where more direct evidence is unavailable.

Assign assurance review to someone competent to interpret the material. Procurement staff can manage the process, but they should not be left to infer technical coverage from unfamiliar audit terminology. Bring security, legal and risk specialists into the relevant decisions. A multidisciplinary review is slower than a checkbox only when the checkbox would have hidden work that still needed to happen.

Check coverage relevance with the right specialists

Request current evidence of professional indemnity coverage and route it to the institution’s insurance or legal specialists. The useful questions include the insured entity, relevant activities, territorial scope, dates, limits, exclusions and treatment of subcontractors. Do not assume that a large headline limit covers the activities proposed in your engagement. Equally, do not invent a universal minimum limit where the applicable requirements and risk decision call for a contextual assessment.

Check whether the policy evidence remains valid throughout the planned engagement and any relevant follow-up period. If renewal occurs during testing, agree how updated evidence will be supplied. Record any condition that must be resolved before work begins. A certificate saved at procurement time should not become a permanent substitute for checking that the stated coverage remains applicable.

Distinguish insurance from operational safety. Insurance does not make an unsafe action acceptable or remove the need for approval, stop authority and restoration procedures. It is one part of the risk arrangement. The contract, technical rules of engagement, provider procedures and institution’s own controls must work together. Keep those review streams connected rather than treating the insurance document as the final safety sign-off.

Where an exclusion appears relevant, ask for a written clarification through the proper channel. Avoid relying on an informal sales assurance that “everything is covered.” Preserve the clarification with the evaluation record and have the appropriate specialist determine whether it resolves the issue. This is a procurement discipline, not an attempt to turn the technical team into insurance advisers.

Follow the results through their full lifecycle

Map how information will move from collection to working notes, reports, review copies, archives and eventual disposal. Include screenshots, recordings, logs, credentials, tool output and chat messages, not only the final PDF. The most sensitive material often exists in intermediate files. Ask which systems hold those files, who can access them and how the provider prevents accidental sharing across customers.

Agree secure exchange before asking for sensitive evidence. Ordinary enquiry forms are not the right place for credentials or detailed architecture. During delivery, use the agreed channels and recipient controls. Define how urgent findings are communicated, how receipt is confirmed and how a mistaken recipient or lost device is handled. These arrangements should be usable under pressure, not merely stated in a policy.

Clarify retention and disposal by information category. Some records may need to be retained for contractual or legal reasons while operational secrets should be removed promptly under the agreed process. Document the applicable basis and approval route rather than choosing an arbitrary universal retention period. Ask what evidence of disposal or restoration will be available at closeout.

Include any external processing services in the review. If a provider proposes using automated analysis, cloud collaboration or AI tools, determine what data would be submitted, under which terms and with what controls. Do not permit sensitive engagement content to enter an unreviewed service merely because it improves convenience. The provider should disclose the proposed workflow and obtain the required contractual and operational approvals.

Keep accountability intact across subcontractors and substitutions

Identify each organisation that will perform a material part of the work and the legal entity responsible for it. Ask what evidence applies to each proposed role, how information is shared and who is accountable for incidents or delivery failures. A prime contractor’s reputation does not automatically establish the capability, insurance or data-handling arrangements of every subcontractor.

Require a change process for personnel and subcontractor substitutions. The process should state when notice is required, what replacement evidence must be supplied and who may approve the change. A replacement may be entirely suitable, but that conclusion needs a review. Avoid a contract that treats all personnel as interchangeable while the procurement assessment relied on specific named expertise.

Check how instructions reach the whole delivery chain. Scope boundaries, stop decisions, confidentiality requirements and restoration obligations should not depend on an informal message between two project managers. Ask for the operational communication structure and escalation route. During a fast-moving test, every participant must know whose instruction controls and how to confirm an ambiguous request.

Use a simple responsibility map for complex engagements. Identify the contracting owner, technical lead, control-team liaison, evidence custodian and incident contact for each workstream. Review the map during kickoff and after material changes. This reduces the chance that a sensitive finding or urgent stop request is delayed because everyone assumes another party is responsible.

Write an approval paper that can survive a later review

The final paper should summarise the proposed scope, delivery model, evaluated team, evidence reviewed, unresolved conditions and decision owners. Explain why the selected provider is suitable for this engagement without claiming that procurement has issued a general regulatory certification. Reference the underlying evidence in controlled storage instead of copying every sensitive document into a broadly circulated approval pack.

Separate mandatory gates from comparative advantages. If two proposals satisfy the required conditions, compare their relevant strengths: clarity of scenario development, quality of reporting examples, continuity arrangements or the fit of specialist experience. Make the weighting visible. This prevents the cheapest price from winning by default and prevents vague reputation from overriding a documented delivery risk.

Record conditions in operational language. “Provide updated insurance evidence before kickoff” is clear. “Subject to compliance” is not. Each condition needs an owner, due date, required evidence and consequence if it remains unresolved. Review conditions at the actual mobilisation decision rather than assuming that a signed contract closed every procurement issue.

Keep the assessment versioned. Store the proposal version, roster and scope that were evaluated. If the engagement later changes significantly, add a focused update explaining the effect on the original decision. This preserves a coherent audit trail without forcing the team to rewrite the entire procurement history for every administrative correction.

Identify evidence that can become stale

Some procurement evidence is relatively stable, while other evidence can change before the exercise begins. A team roster, insurance period, subcontractor arrangement or defensive-services relationship may require confirmation close to mobilisation. Mark those items in the register with a review trigger. This prevents a decision based on an accurate document from becoming unreliable simply because the underlying circumstance changed.

Use targeted renewal rather than restarting the whole assessment. If one assigned specialist changes, inspect the replacement’s relevant evidence and the effect on team coverage. If an insurance document is renewed, route the updated scope and exclusions to the appropriate reviewer. Preserve the original decision and the update so that the record remains coherent. This approach keeps procurement proportionate while ensuring that the institution relies on the actual delivery arrangement, not a historical proposal that no longer describes the people or controls in use.

Hand the decision to the delivery owner

Before procurement closes, give the delivery owner a short briefing on the conditions and assumptions that mattered most. Explain which personnel were evaluated, which relationships require separation, which evidence must be renewed and which contractual commitments support safe operation. This prevents the delivery team from unknowingly undoing a carefully assessed arrangement. Ask the owner to acknowledge the handoff and identify the place where changes will be recorded. The result is continuity between a defensible purchasing decision and the practical management of the exercise.

Use procurement evidence at mobilisation, not only at selection

At kickoff, confirm that the approved team, roles, channels and operating assumptions still match reality. Check that outstanding conditions have been closed and that the relevant participants understand the scope and escalation process. The procurement file is useful input to this conversation; it should not disappear into an archive as soon as the purchase order is issued.

Agree which changes require renewed review during delivery. Examples include a new subcontractor, a material scope expansion, a different information-processing platform or a change in the provider’s relationship with the defensive team. Give the engagement lead a clear notification route. A well-designed change process supports delivery rather than surprising the provider with retrospective objections.

After completion, review the provider against the same outcomes used during selection. Did the assigned team deliver? Were communications and evidence handling effective? Did the report support remediation? Were restoration obligations completed? Capture lessons for the next procurement without disclosing sensitive testing details beyond the authorised group. This creates institutional knowledge rather than repeating the same questionnaire every cycle.

To prepare an engagement discussion, use our TLPT scoping brief or contact Atlant Security with the functions, timing and authority context. Do not send confidential assessment material before agreeing a secure exchange. This guide was reviewed on 25 October 2026; it provides practical procurement recommendations and does not replace legal advice, the current regulation or the responsible authority’s decision.