Twelve weeks is one phase, not the whole programme
The TLPT RTS requires the active red-team testing phase to last at least 12 weeks. That does not mean a complete DORA TLPT can be booked, executed and closed within 12 weeks. Preparation, procurement, threat intelligence, planning, reporting and closure all require time.
The overall timetable depends on scope, participants, operational constraints and the authority process. A fixed total duration quoted before those factors are understood should be treated as an assumption to investigate.
What needs to happen before active testing
Preparation includes the control team, authority engagement, proposed scope, provider selection and contractual arrangements. Threat intelligence and red-team planning then turn that scope into relevant scenarios and controlled activity.
Third-party participation and cross-border coordination can be significant scheduling dependencies. So can the availability of named specialists, the quality of function mapping and the process for reviewing proposed documents. These should be visible on the programme plan rather than hidden as contingency.
Protect the active-testing window
Under RTS Article 11(5), the active red-team phase has a minimum of 12 weeks. Scheduling should respect the applicable requirements for the phase and any permitted methodology decisions. Limited purple teaming has a specific role under the RTS; it is not an informal workaround for an undersized engagement.
Agree escalation paths, operational restrictions and the handling of genuine incidents. A testing calendar that ignores production change or key participant availability can create unnecessary risk and delays.
Reserve time for closure and remediation planning
The RTS includes deadlines and report content requirements. For example, the red-team report is due within four weeks after the active phase; the blue-team report has a separate deadline linked to receipt of that report and no later than ten weeks after active testing ends.
Further timing requirements apply to the test summary and remediation plans. Some are triggered by authority notifications, so they cannot all be calculated simply by adding a fixed number of weeks to the first day of testing. Read Articles 12 and 13 with the authority’s operating process.
What a credible schedule shows
- Phase boundaries and the assumptions behind them.
- Who reviews each document and the expected review window.
- Procurement, third-party and authority dependencies.
- Active testing, reporting, replay and purple-team participation.
- Remediation planning and follow-through responsibilities.
Build backward from known constraints, but do not compress mandatory activity to fit an arbitrary deadline. A scoping conversation should produce a timetable with named dependencies and explicit uncertainty.
Continue your preparation
Primary sources
General information, not legal advice. Confirm the applicable requirements and test arrangements with your relevant authority.
