Threat-led penetration testing (TLPT)
A controlled, bespoke, intelligence-led red-team test that models credible threat actors against critical live production systems. In DORA, advanced testing has a defined regulatory context and authority process.
Digital Operational Resilience Act (DORA)
Regulation (EU) 2022/2554, which establishes digital operational resilience requirements for the financial sector. TLPT is one component, alongside wider ICT risk management and other obligations.
Regulatory technical standards (RTS)
Detailed requirements supplementing legislation. For DORA TLPT, Commission Delegated Regulation (EU) 2025/1190 addresses selection, methodology, participants, closure and related matters.
TIBER-EU
The European framework for threat intelligence-based ethical red teaming. It provides operational guidance and templates; it is not a commercial provider accreditation.
Critical or important function
A function whose disruption would materially impair relevant financial performance, service continuity or regulatory compliance as described in DORA. TLPT scoping maps these functions to the resources that support them.
Control team
The restricted group within the tested entity that knows about and manages the exercise. Its lead coordinates with the authority’s test managers and relevant providers.
Blue team
The defenders whose prevention, detection and response capabilities are being tested. Their observations are essential to closure and learning.
Red team
The testers who execute agreed adversary scenarios within the authorised scope and rules of engagement.
Targeted threat intelligence
Analysis of relevant threats and the entity’s exposure used to guide scenario selection and testing. It should make the link between the threat and the tested functions explicit.
Purple teaming
Structured collaboration between attackers and defenders to understand outcomes, explore gaps and improve controls. Its role and timing must follow the applicable test requirements.
Attestation
Documentation from the relevant authority process supporting recognition of a TLPT performed in accordance with requirements. It does not certify all aspects of an entity’s DORA compliance.
Primary sources
- DORA · Regulation (EU) 2022/2554
- TLPT RTS · Delegated Regulation (EU) 2025/1190
- ECB · TIBER-EU framework and guidance
General information, not legal advice. Confirm the applicable requirements and test arrangements with your relevant authority.
