DORA TLPT Readiness Checklist | Before You Appoint Testers

What this means for your test

Use this checklist to expose missing decisions before procurement. Confirm the authority process, proposed critical-function scope, control-team ownership, provider due diligence and third-party permissions. Reserve reporting and remediation ownership before active testing starts.

Confirm the obligation

• Identify the legal entity and relevant competent / TLPT authority.
• Find the selection notification and agreed testing window, if issued.
• Confirm applicable DORA, RTS and authority requirements.

Prepare the scope

• List critical or important functions proposed for testing.
• Map the systems, people, processes and ICT dependencies supporting them.
• Identify cross-border entities, shared services and third-party participation.
• Record scope assumptions that require authority validation.

Establish governance

• Nominate the control-team lead and a suitably restricted control team.
• Define confidentiality, escalation, incident handling and stop conditions.
• Identify who approves scope changes and operational restrictions.

Prepare provider due diligence

• Request named team expertise and availability.
• Assess conflicts, relevant ethical frameworks and assurance evidence.
• Check professional indemnity cover for the proposed work.
• Agree evidence handling, subcontracting and contractual responsibilities.

Plan closure before testing

• Assign red-team, blue-team and summary-report responsibilities.
• Reserve time for replay, purple teaming and remediation planning.
• Set a process for remediation ownership, evidence and follow-through.
• Agree secure report distribution and retention arrangements.