DORA TLPT Engagement | From Validated Scope to Closure

What this means for your test

DORA TLPT combines a defined authority process with threat-led testing of critical or important functions. Establish the selected entity, proposed scope, provider responsibilities and live-system safeguards before treating it as a technical exercise. Agree the evidence needed throughout preparation, testing and closure.

A test of operational resilience

TLPT combines targeted threat intelligence with controlled red-team testing of critical live production systems. It examines how people, processes and technology respond to a credible adversary, including the ability to detect and contain an attack.

Atlant Security offers DORA TLPT as one integrated engagement. The starting point is your organisation’s designation, critical or important functions, authority expectations and operational constraints. The proposed scope, team and delivery arrangements are established before testing begins.

What the engagement covers

• Preparation and scoping: map critical functions, production systems and ICT dependencies; document governance and testing boundaries.
• Threat intelligence: identify relevant adversaries, exposure and credible scenarios that guide the red-team plan.
• Controlled testing: execute agreed scenarios with control-team oversight, documented risk controls and escalation procedures.
• Closure and learning: support reporting, red/blue replay and purple-team exercises.
• Remediation planning: translate findings into actions, owners and evidence that supports the authority’s closure process.

Responsibilities, provider roles and final deliverables are agreed in the statement of work. See the methodology and deliverables for the detailed model.

Live-system testing requires explicit safeguards

The engagement must have written authorisation, validated scope, clear rules of engagement and a risk-management process. Operational owners and the control team define stop conditions, escalation contacts, restrictions, data handling and recovery arrangements. Third-party involvement is agreed before activity reaches shared services.

Testing can carry operational risk. Its management is part of the test design, rather than a promise that disruption is impossible. No test activity is authorised by submitting this website’s enquiry form.

Start with fit, scope and evidence

Tell us whether your authority has identified your entity for TLPT, which functions may be in scope and your expected testing window. A scoping discussion can establish the procurement information needed to assess the proposed team, provider suitability and approach.

Article 27 due diligence remains essential. Confirm the named team’s expertise, relevant assurance, independence and insurance before appointment. See our provider procurement checklist.

Scope determines duration and fees

There is no published fixed-price package. The number of entities and functions, dependencies, scenarios, provider involvement and closure requirements all affect the engagement. The RTS minimum of 12 weeks applies to active red-team testing, not the entire programme.

A proposal should set out assumptions, responsibilities, costs and change control clearly. The outcome supports your resilience and regulatory process; it is not a blanket DORA compliance guarantee.

Prepare a brief before the scoping call

Turn an authority notification or an early planning discussion into a useful starting brief. Identify the functions and dependencies that need clarification before a TLPT scope can be agreed.

Use the free dora tlpt brief builder to record objectives, assessment areas, constraints and NDA preferences. Review the proposed scope, then send it directly to Atlant Security through the contact form.