Procure the capability. Verify the evidence.

Start with the actual delivery team

Evaluate the provider and the named people who will perform the work. A company’s marketing material does not establish the availability, suitability or independence of the team proposed for your test.

Ask for the evidence required by DORA Article 27, the RTS and your authority’s procurement expectations. Agree the process for substitutions and subcontracting before work begins.

Questions for your due-diligence pack

• Expertise: what relevant threat intelligence, penetration testing and red-team experience can the proposed team substantiate?
• Suitability: how are reputation, references and potential conflicts assessed?
• Ethical framework: what applicable accreditation, certification or formal code of conduct is relied on?
• Independent assurance: what assurance or audit evidence supports the management of TLPT risks and confidential information?
• Insurance: does the professional indemnity coverage address the proposed activities and associated risks?
• Data handling: where will evidence be processed, who can access it and how will it be retained and deleted?
• Delivery continuity: how are named resources, escalation coverage and provider dependencies managed?

Compare proposals on the same assumptions

Provide a common brief: legal entities, relevant authority, possible critical functions, geographical and ICT dependencies, expected timetable and governance. Require proposals to identify unknowns rather than hide them inside a fixed promise.

Discuss an engagement with Atlant Security

This site presents a DORA TLPT service. It does not publish unverified accreditation, insurance or regulator-approval claims. The proposed team, capability evidence, delivery responsibilities and contractual terms must be assessed as part of scoping and procurement.

Start a procurement conversation using non-sensitive details. Arrange a confidential channel before exchanging due-diligence records or system information.