WORKING RESOURCE / SCOPE & PROCUREMENT

Build a DORA TLPT scoping brief

Turn an authority notification or an early planning discussion into a useful starting brief. Identify the functions and dependencies that need clarification before a TLPT scope can be agreed.

Define the objective.
Set the boundaries.
Leave with a working brief.

No signup required
Copy, download or print
Your draft stays in this page

Keep it high level. The brief is a planning aid. It is not an approved TLPT scope, an assessment of provider eligibility or a DORA compliance determination.

Your choices are processed in your browser. They are not sent, saved in browser storage or shared with AI. Copy or download your brief before leaving.

01 The decision you need

Assessment objective

Authority / designation status

A conventional pentest and a statutory DORA TLPT have different purposes. This brief does not decide designation or replace authority validation.

02 The assessment boundary

Choose the areas you want to discuss. Final coverage is agreed during scoping.

Critical or important functionsIdentity and privileged accessProduction applications and infrastructureICT third-party dependenciesDetection, response and control-team arrangements

Proposed environment

Operating constraints (optional)

For example: shared providers, cross-border functions, control-team availability or an authority testing window.

03 Timing and permissions

Indicative timing

Supplier permissions

NDA preference

YOUR WORKING BRIEF

Ready for a better
scoping conversation.

0 of 7 planning points captured

Review and copy your draft

DORA threat-led penetration testing — initial scoping brief
DRAFT FOR DISCUSSION · not authorisation to test

Assessment objective: To be agreed
Primary context: To be agreed
Environment: To be agreed
Indicative timing: To be agreed
Supplier permissions: To be agreed
NDA preference: To be agreed
Assessment areas: To be agreed
Operating constraints: To be discussed

Questions to resolve:
- Assessment areas
- Assessment objective
- Primary context
- Environment
- Indicative timing
- Supplier permissions
- NDA preference

Next step: agree scope, named owners, safeguards, deliverables and commercial terms.
Do not include credentials, patient/customer records or confidential technical evidence.

Copy the brief into your enquiry message, or email it to sales@tlptdora.com. Nothing is sent automatically.

WHAT TO INCLUDE / DORA TLPT

Scope choices that change the test.

Assessment area	What to describe	What useful evidence answers
Critical functions	Name the business outcome and the systems, people and providers that support it.	A function-to-system map and scope assumptions for the authority process.
Threat-led scenarios	Describe relevant threat concerns and the functions at risk.	Scenario objectives tied to targeted threat intelligence; not a generic vulnerability list.
Governance and closure	Identify the authority process, control-team lead and required outputs.	A delivery responsibility matrix, test safeguards and closure/remediation plan.

BEFORE THE SCOPING CALL

Bring the right context.

Authority correspondence and applicable test arrangements
An initial map of critical functions and ICT dependencies
Named governance, confidentiality and stop-authority roles
Provider due-diligence evidence and expected closure outputs

Open the full readiness checklist ↗

THE NEXT DECISION

From the brief to an agreed TLPT scope

Confirm the authority process and provider suitability, then validate the functions, responsibilities and safeguards before any testing begins.

Coverage, environments, role combinations, supplier coordination and retesting affect effort. A brief helps expose those assumptions; it is not a price or delivery commitment.

See how the evidence is reported ↗

Method and source references

Read the scope guide · Evaluate a provider · How we publish our guidance