Today the EU provided the long awaited updated guidance in relation to DORA’s TLPT: DORA TLPT Guidance Update
This 30 page document further clarifies the necessity for Threat-Led Penetration Tests (TLPTs) under DORA.
We will be posting a more in-depth post about this in the very near future, but the key points that should be taken away are:
Who can Invoke a TLPT?
DORA’s TLPT requirements mirrors the TIBER-EU methodologies, process and structures – they will use the same structure for overseeing DORA TLPT’s as TIBER-EU engagements and will be overseen by either EU or national level authorities. The authorities are defined as those who are the single designated public authority for the financial sector; or an authority in the financial sector who has been authorised and delegated to manage TLPTs; or any competent authorities referred to in Article 46 of Regulation (EU) 2022/2554.
Who is in scope for a TLPT?
It will be down to the national or EU wide authorities to determine who will be in scope for a TLPT test; however the guidance is clear that it should be restricted to entities for which it is justified. This can include financial entities that operate in core financial services subsectors, as long as a TLPT cannot be justified for them.
Ultimately this means it will be down to the regulator’s discretion as to whether or not a TLPT should apply for any financial organisation and will be taken on a case-by-case basis. This will be based on the overall assessment of an organisation’s ICT (Information and Communications Technology) risk profile and maturity, the impact on the financial sector and of related financial stability concerns which must meet qualitative criteria.
In Article 2 of the update the specific requirements for the identification of financial entities required to perform TLPTs are defined. Essentially the authorities will consider the following factors:
- The size of the entity
- The extent and nature of the financial entities connections with other entities in the financial sector of one or more EU member states.
- The criticality or importance of the services the entity provides to the financial sector
- The substitutability of services the entity provides
- The complexity of the entity’s business model
- The entity’s role in a wider enterprise with shared ICT systems
The authorities will also consider the following ICT risk-related factors:
- The entity’s risk profile
- The threat landscape for the entity
- The degree of dependence their critical/important/supporting functions have from ICT systems
- The complexity of the entity’s ICT architecture
- The entity’s ICT services which are supported by third parties (including the quantity and contractual arrangements for third party and intra-group service providers)
- The outcomes of any supervisory reviews relevant for assessment of the ICT maturity of the entity
- The maturity of ICT business continuity plans and the ICT response and recovery plans
- The maturity of ICT detection and mitigation controls
- And whether the entity is part of group that is active in the financial sector of the EU that shares ICT systems.
The expectation is that that TLPT will be required for entities such as:
credit institutions, payment and electronic money institutions, central security depositories, central counterparties, trading venues, insurance and reinsurance undertakings. The definitions for these types of entities is included in the update and many will be related to their definition in other EU articles (all referenced), or in relation to total payment transactional amounts within a 2 year calendar period, or for entities which provide undertakings for gross written premiums (GWPs) or technical provisions above specified levels. It should be noted however that these same entities could be excused from a TLPT if the authority agrees it is inappropriate.
The authority is also required to consider points such as market share positions, and the range of activities the financial entity provides when making this assessment.
Furthermore, that criteria must also be applied and assessed in light of new markets as they enter the financial sector, such as crypto asset service providers authorised under Article 59 of Regulation (EU) 2023/1114 of the European Parliament and of the Council.
Shared ICT Service Providers
The guidance also touches on financial entities that have the same ICT service provider. In those cases it will be down to the regulator as to whether a shared or entity level assessment is conducted, if a TLPT is deemed necessary.
If a TLPT is deemed as required by the authority, then the financial entity will be contacted and clearly presented with the authority’s expectation with regards to testing.
This regulation update will come into force 20 days after its publication (8th July 2025), so after this date is when entities could be contacted by letter from authorities notifying them of the requirement to conduct a TLPT test.
Additional Notes
Much of the rest of the regulation update covers the delivery of a TLPT in regards to roles, responsibilities, and expectations for TLPT providers (both Threat Intelligence and Red Team/Penetration testers). It also covers the basic expectations for financial entities being tested with regards to secrecy, procurement and scoping of the TLPT engagements. We will touch on those topics in more detail in a later blog post.
