Start with the legal hierarchy
DORA establishes the advanced-testing framework and tester requirements. Delegated Regulation (EU) 2025/1190 supplies the detailed TLPT rules. TIBER-EU offers operational guidance; a marketing claim of TIBER alignment does not by itself establish that a particular proposal meets the applicable process.
Examine the proposed people
Ask who will actually perform the work, which qualifications and experience support the role, and what happens if a named specialist is unavailable. Evaluate Article 27 requirements against evidence for the proposed testers rather than assuming the corporate brand establishes individual suitability.
Separate intelligence and execution
A proposal should explain how intelligence becomes plausible scenarios and how approved scenarios become controlled actions. Request an illustrative handoff with sensitive material removed. A generic threat landscape and a pre-written red-team plan can fit neatly together on paper without addressing your critical function.
Clarify control-team authority
Ask the bidder to describe a situation in which a planned action becomes unsafe. Who notices, who can pause work, and who authorises a changed method? The institution should understand its own governance responsibilities instead of relying on the provider's general assurance that the work is safe.
Interrogate exclusions
Ask how scope constraints are surfaced to the control team and relevant authority. A bidder should identify the assurance lost when a dependency cannot be exercised. Covering that dependency in a diagram is not equivalent to having tested it.
Compare closure obligations
Ask who produces which reports, who supports collaborative review and what work is included after active testing. Confirm how successful and unsuccessful paths, assistance, limitations and proposed remediation are represented. Provider delivery and authority attestation are distinct steps.
Score one worked case
Give each bidder the same fictional critical function and supplier constraint. Score the proposed handling of intelligence, governance, safe execution and closure. Record which conclusions rely on documents already supplied and which depend on further evidence. This produces a procurement record your control team can use after award.
A shortlist exercise that reveals missing work
One bidder offers a strong red team and five weeks of activity. Another also describes intelligence development, control-team coordination and closure support. Do not assume that the second bid automatically complies or that the first cannot deliver. Ask both to allocate responsibility for each required workstream and name the evidence that will exist at handover.
| Comparison item | Weak answer | Useful answer |
|---|---|---|
| Tester eligibility | Our company is experienced | Evidence for the named team and applicable Article 27 criteria. |
| Production safety | We use safe techniques | Decision owners, escalation route and agreed stop process. |
| Closure support | A final PDF is included | Defined outputs, review sessions and unresolved responsibilities. |
Primary texts: DORA, Articles 26 and 27 and Commission Delegated Regulation (EU) 2025/1190.
Published by Atlant Security. Sources, editorial policy and corrections.
