RTS on TLPT (Final Report)

Abstract

Final draft Regulatory Technical Standards under DORA specifying detailed requirements for threat-led penetration testing (TLPT), including criteria for identifying entities required to perform TLPT, testing methodology and phases, use of internal testers, cooperation between authorities, and remediation and reporting requirements. The standards align TLPT with the TIBER-EU framework to enhance cyber resilience of financial entities.

Key Takeaways

• ✓
  Defines criteria and methodology for conducting threat-led penetration testing under DORA Article 26.
• ✓
  Specifies phases of TLPT including preparation, threat intelligence, red-team testing, and closure with remediation planning.
• ✓
  Establishes requirements for internal and external testers and threat intelligence providers.
• ✓
  Provides rules for pooled and joint TLPTs and supervisory cooperation across Member States.
• ✓
  Aligns DORA testing framework with the TIBER-EU methodology to ensure realistic and intelligence-led cyber resilience testing.

Keywords