How to compare proposals fairly
Ask each provider to price the same critical functions, threat scenarios and live-system dependencies and explain assumptions about roles, access, environments and test windows. Request relevant delivery-team evidence and a report sample. Compare the proposed testing and retesting work before comparing day rates; the lowest number may describe a different engagement.
Start with the actual delivery team
Evaluate the provider and the named people who will perform the work. A company’s marketing material does not establish the availability, suitability or independence of the team proposed for your test.
Ask for the evidence required by DORA Article 27, the RTS and your authority’s procurement expectations. Agree the process for substitutions and subcontracting before work begins.
Questions for your due-diligence pack
- Expertise: what relevant threat intelligence, penetration testing and red-team experience can the proposed team substantiate?
- Suitability: how are reputation, references and potential conflicts assessed?
- Ethical framework: what applicable accreditation, certification or formal code of conduct is relied on?
- Independent assurance: what assurance or audit evidence supports the management of TLPT risks and confidential information?
- Insurance: does the professional indemnity coverage address the proposed activities and associated risks?
- Data handling: where will evidence be processed, who can access it and how will it be retained and deleted?
- Delivery continuity: how are named resources, escalation coverage and provider dependencies managed?
Compare proposals on the same assumptions
Provide a common brief: legal entities, relevant authority, possible critical functions, geographical and ICT dependencies, expected timetable and governance. Require proposals to identify unknowns rather than hide them inside a fixed promise.
| Contract item | What to clarify |
|---|---|
| Scope and authorisation | Functions, systems, legal permissions, exclusions and validation process. |
| Risk controls | Stop conditions, incident handling, provider coordination and liability allocation. |
| Outputs | Reports, templates, audience, ownership and secure transfer. |
| Resources | Named roles, experience, availability, replacement and subcontracting. |
| Commercial terms | Phase assumptions, fees, changes, delays and any retesting. |
Discuss an engagement with Atlant Security
This site presents a DORA TLPT service. It does not publish unverified accreditation, insurance or regulator-approval claims. The proposed team, capability evidence, delivery responsibilities and contractual terms must be assessed as part of scoping and procurement.
Start a procurement conversation using non-sensitive details. Arrange a confidential channel before exchanging due-diligence records or system information.
Primary sources
- DORA · Regulation (EU) 2022/2554
- TLPT RTS · Delegated Regulation (EU) 2025/1190
- ECB · TIBER-EU framework and guidance
General information, not legal advice. Confirm the applicable requirements and test arrangements with your relevant authority.
Prepare a brief before the scoping call
Turn an authority notification or an early planning discussion into a useful starting brief. Identify the functions and dependencies that need clarification before a TLPT scope can be agreed.
Use the free dora tlpt brief builder to record objectives, assessment areas, constraints and NDA preferences. Review the proposed scope, then send it directly to Atlant Security through the contact form.
