DORA TLPT. One integrated engagement.

A test of operational resilience

TLPT combines targeted threat intelligence with controlled red-team testing of critical live production systems. It examines how people, processes and technology respond to a credible adversary, including the ability to detect and contain an attack.

Atlant Security offers DORA TLPT as one integrated engagement. The starting point is your organisation’s designation, critical or important functions, authority expectations and operational constraints. The proposed scope, team and delivery arrangements are established before testing begins.

What the engagement covers

• Preparation and scoping: map critical functions, production systems and ICT dependencies; document governance and testing boundaries.
• Threat intelligence: identify relevant adversaries, exposure and credible scenarios that guide the red-team plan.
• Controlled testing: execute agreed scenarios with control-team oversight, documented risk controls and escalation procedures.
• Closure and learning: support reporting, red/blue replay and purple-team exercises.
• Remediation planning: translate findings into actions, owners and evidence that supports the authority’s closure process.

Responsibilities, provider roles and final deliverables are agreed in the statement of work. See the methodology and deliverables for the detailed model.

Live-system testing requires explicit safeguards

The engagement must have written authorisation, validated scope, clear rules of engagement and a risk-management process. Operational owners and the control team define stop conditions, escalation contacts, restrictions, data handling and recovery arrangements. Third-party involvement is agreed before activity reaches shared services.

Testing can carry operational risk. Its management is part of the test design, rather than a promise that disruption is impossible. No test activity is authorised by submitting this website’s enquiry form.

Start with fit, scope and evidence

Tell us whether your authority has identified your entity for TLPT, which functions may be in scope and your expected testing window. A scoping discussion can establish the procurement information needed to assess the proposed team, provider suitability and approach.

Article 27 due diligence remains essential. Confirm the named team’s expertise, relevant assurance, independence and insurance before appointment. See our provider procurement checklist.

Scope determines duration and fees

There is no published fixed-price package. The number of entities and functions, dependencies, scenarios, provider involvement and closure requirements all affect the engagement. The RTS minimum of 12 weeks applies to active red-team testing, not the entire programme.

A proposal should set out assumptions, responsibilities, costs and change control clearly. The outcome supports your resilience and regulatory process; it is not a blanket DORA compliance guarantee.