No. TLPTs aren’t just regular pentests and definitely aren’t a simple vulnerability scan which many vendors might want you to believe.

TLPT essentially describes red team engagements with a threat intelligence (TI) phase where a TI team gathers intelligence about the threats that the company might face. Those threats are then mimicked during the attack phase by the red team to create a realistic assessment.

After the attack phase of the engagement, the red team and the blue team will work together to review the course of events. This includes determining what went well and what went wrong as well as finding and closing gaps in the detection capabilities. This will be achieved with so-called Purple Teaming.

All in all such an assessment takes at least 12 weeks and is the ultimate test for your IT security.

DORA specifies two different intervals for security assessments:

• Appropriate tests (e.g. vulnerability assessments and scans, physical security reviews, source code reviews and penetration testing) at least yearly on all ICT systems and applications supporting critical or important functions.
• Threat-led penetration testing at least every 3 years (the competent authority may, however, change this interval).

That depends on the current state of affairs within your company. If you are performing regular internal and external audits and have an IT risk management framework in place (e.g. based on ISO 27001), you most likely just need to perform a TLPT every three years.

TLPTs are however a cost to budget for. The RTS specifying the TLPT test procedure requires currently that “the active red teaming test has to be a minimum of 12 weeks”. In combination with all necessary preparations, the TI phase and the closure phase with purple teaming and reporting, you should plan for a duration of at least half a year. In our experience, it is better to calculate with one year from start to finish.

If you are just starting to implement a risk management framework, you should plan with at least a year to setup the necessary risk management processes and procedures.

Dora only mandates TLPT and not TIBER-EU in particular. However, TIBER-EU is planned to satisfy the requirements for TLPT in the future. That means if you already perform security assessments according to the TIBER-EU framework, you should be fine.

The entities affected are defined in Art. 2 of DORA. It includes financial entities (e.g. banks, insurance companies, investment firms) as well as so-called ICT third-party service providers. The latter includes all third parties that provide ICT (Information Communication Technologies)-related services to the financial entities themselves.

Plainly speaking: If you are managing money in some way or another or you provide ICT services (e.g. software engineering) to those who do, you are most likely affected.

Art. 4 of DORA defines the “Proportionality Principle”:

“Financial entities shall implement the rules laid down in Chapter II in accordance with the principle of proportionality, taking into account their size and overall risk profile, and the nature, scale and complexity of their services, activities and operations.”

This is manifested at multiple places within DORA itself, e.g.:

• DORA allows smaller companies to implement just a Simplified ICT risk management framework.
• Smaller companies don’t need to perform threat-led penetration tests.
• “Microenterprises” have a set of further exemptions and amendments, e.g. they are mostly excluded from the regulations related to digital operational resilience testing, but should instead perform ICT testing based on a risk-based approach.

• TLPTs are a real-life attack simulation consisting of a threat-intel phase and an at least twelve-week-long red teaming phase.
• TLPTs are not simple scans, vulnerability assessments or pentests.
• TIBER-EU is an older framework that provides comprehensive guidance on how to perform threat intelligence-based ethical red-teaming.
• TIBER-EU (soon) complies with the requirements for DORA TLPT.

The requirements for external testers who can perform TLPTs can be found in the RTS but aren’t final yet.

At the time of writing the requirements for the red team are roughly as follows:

• A team consisting of a manager with at least five years of experience plus two additional testers each with at least two years of experience
• A broad range and appropriate level of professional knowledge
• Combined participation in at least five previous assessments related to TLPTs

Now. At least if you are new to the realm of pentesting and red teaming. TLPTs are complex and are performed on production systems. Therefore, they need to be properly prepared, with at least basic security and recovery measures in place.

DORA itself will apply from the 17.01.2025. Until then, you will have to comply with the regulation. That means, among other things, having an effective ICT risk management framework in place and performing regular resilience tests.

During the so-called Purple Teaming, the Red Team and Blue Team work closely together. The goal is to refine the capabilities of the Blue Team through active communication and replaying the assessment. What went wrong? What went well? How can the detection and response capabilities be improved?