8 min read<\/p>\n
4 min. read<\/p>\n
DORA requires systemically important financial institutions to conduct regular threat-led penetration tests on production systems. No test lab, no sandbox: real attacks on real infrastructure, without the Blue Team knowing. The first notifications from supervisory authorities will be issued in 2026. CIOs in the financial sector who are not prepared now have a problem on a short timeline.<\/strong><\/p>\n Most companies are familiar with penetration tests: an external team checks defined systems for vulnerabilities, documents the results and provides recommendations. The test runs on test systems or within a defined scope, the internal security team is informed, and the results feed into the next audit report.<\/p>\n TLPT under DORA is something fundamentally different. Three dimensions distinguish TLPT from conventional pentests. First: secrecy. The Blue Team, meaning the internal IT security team, does not know that a test is taking place. Only a small circle in management is informed (the so-called White Team). Second: production systems. The test runs on the real infrastructure, not on copies or test environments. The risks are real, the results are meaningful, and a mistake by the Red Team can have actual consequences. Third: threat intelligence first. Before the Red Team attacks, a separate threat intelligence provider analyzes the institution’s specific threat landscape. The attack simulates real threat actors with real tactics, not a generic playbook.<\/p>\n The effort involved is considerable: a complete TLPT cycle takes 6 to 12 months. The red team phase alone has a minimum duration of 12 calendar weeks. Added to this are scoping, threat intelligence analysis, purple teaming (joint analysis with the Blue Team after the test ends) and the final report. For CIOs who have only dealt with standard pentests so far, TLPT is in a different league.<\/p>\n “Threat-led penetration testing enables financial institutions to identify vulnerabilities early and test the resilience of their ICT systems under realistic conditions.”<\/p>\n BaFin, “Simulating attacks to enhance security” (December 2024)<\/cite>\n<\/p><\/blockquote>\n Not every financial company is subject to the TLPT obligation. DORA limits the requirement to institutions of systemic relevance. Specifically affected are: Global Systemically Important Institutions (G-SIIs) and Other Systemically Important Institutions (O-SIIs), institutions that processed more than 150 billion euros in payment transactions in each of the last two financial years, central securities depositories (CSDs) and central counterparties (CCPs).<\/p>\n In Germany, this includes the major institutions: Deutsche Bank, Commerzbank, DZ Bank, the Landesbanken and systemically relevant insurers. But specialized payment service providers that exceed the transaction threshold may also be affected. The supervisory authorities (BaFin and the Bundesbank in Germany) individually designate the institutions subject to the obligation. The first wave of notifications is underway in 2026.<\/p>\n For CIOs outside the financial sector, TLPT is still relevant: NIS2<\/a> contains similar requirements for regular security testing for essential entities. The TLPT methodology is likely to become the gold standard for resilience testing outside DORA as well.<\/p>\n TLPT under DORA is based on the TIBER-EU framework (Threat Intelligence-Based Ethical Red Teaming), which the European Central Bank introduced in 2018. In Germany, the Deutsche Bundesbank implements this framework as TIBER-DE, currently in version 4.0 (July 2025).<\/p>\n The TIBER-DE requirements are consistent with the DORA TLPT requirements, but impose slightly stricter preliminary requirements in some areas. The Bundesbank provides operational support for the tests; BaFin is the competent supervisory authority for supervisory tasks. Institutions that have already carried out a TIBER-DE test have a significant head start over institutions starting from scratch.<\/p>\n Important for CIOs: The threat intelligence provider must always be external. Every third test must be carried out with an external red team (the others may be internal, provided the internal red team meets the DORA requirements). Purple teaming is mandatory in the final phase. This means that the red team and the blue team jointly analyze what worked and what did not. This phase is the most valuable part of the test because it delivers concrete improvements.<\/p>\n Sources: DORA (EU 2022\/2554), EBA Final RTS on TLPT, Bundesbank TIBER-DE v4.0<\/p>\n 1. Clarify whether you are affected.<\/strong> Does your institution fall under the TLPT requirement? The criteria are clear (G-SII\/O-SII, transaction volume above 150 billion euros, CSD\/CCP). If in doubt, contact BaFin proactively. Anyone who only finds out they are affected when the official notification arrives will have too little lead time.<\/p>\n 2. Form a White Team.<\/strong> The White Team manages the TLPT internally. It typically consists of the CIO\/CISO, risk management and a representative of the management board. The White Team must commission the test, define the scope and ensure confidentiality vis-a-vis the Blue Team. Its composition should be defined in advance, not only once the notification arrives.<\/p>\n 3. Evaluate external providers.<\/strong> Threat intelligence providers and red team service providers need to be selected early. The availability of qualified TLPT providers is limited, especially if the first notification wave activates many institutions at the same time. CIOs should prepare framework agreements with at least two providers. Qualification criteria: CREST certification, TIBER experience, references from comparable institutions.<\/p>\n 4. Prepare the scope.<\/strong> The TLPT scope must cover critical business functions and their supporting IT systems. This requires up-to-date documentation of critical services, the underlying infrastructure and dependencies. Institutions that have not kept their cybersecurity architecture documentation current will run into difficulties when defining the scope.<\/p>\n 5. Review internal resilience.<\/strong> TLPT reveals weaknesses that then need to be remediated. CIOs should close obvious gaps before the test: unpatched systems, missing network segmentation, outdated access rights. Not to pass the test, but because these gaps represent real risks. A TLPT that finds trivial vulnerabilities wastes the budget on the obvious instead of on the subtle risks that deliver the real added value.<\/p>\n The TLPT does not end with the final report. The results must feed into a concrete action plan, whose implementation is tracked by the supervisory authority. BaFin expects identified vulnerabilities to be remediated within defined deadlines. The board must approve the action plan and monitor its implementation.<\/p>\n For CIOs, TLPT therefore means not just a one-off effort, but a continuous improvement cycle. The personal liability<\/a> of management under DORA makes this cycle a top-level issue. CIOs who treat TLPT as an annoying regulatory obligation miss its real value: a realistic stress test of their own defensive capabilities that no internal exercise can provide.<\/p>\n TLPT is performed on production systems (not test environments), the Blue Team knows nothing about it (confidentiality), and the attack is based on an individual threat intelligence analysis of the institution. A standard pentest runs on defined test systems with the knowledge of everyone involved.<\/p>\n<\/details>\n Global and national systemically important institutions (G-SII\/O-SII), institutions with more than 150 billion euros in payment transactions over the past 2 years, central securities depositories, and central counterparties. BaFin identifies the institutions subject to the requirement individually.<\/p>\n<\/details>\n The full cycle takes 6 to 12 months. The Red Team phase alone has a minimum duration of 12 weeks. In addition, there is the threat intelligence analysis (4 to 8 weeks), scoping (2 to 4 weeks), Purple Teaming (2 to 4 weeks), and the final report.<\/p>\n<\/details>\n Purple Teaming is the joint analysis by the Red Team (attackers) and Blue Team (defenders) after the test has ended. Only at this point does the Blue Team learn that a test took place. Together, they analyze detection gaps, response times, and escalation processes. Purple Teaming is mandatory under DORA.<\/p>\n<\/details>\n Not under DORA. But NIS2 contains similar requirements for regular security testing for essential entities. The TLPT methodology is expected to become the gold standard for resilience testing outside the financial sector as well.<\/p>\n<\/details>\n Title image source: Sora Shimazaki \/ Pexels<\/em><\/p>\n 8 min read 4 min. read DORA requires systemically important financial institutions to conduct regular threat-led penetration tests on production systems. No test lab, no sandbox: real attacks on real infrastructure, without the Blue Team knowing. The first notifications from supervisory authorities will be issued in 2026. CIOs in the financial sector who are not […]<\/p>\n","protected":false},"author":82,"featured_media":12809,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"cyber-resilience test","_yoast_wpseo_title":"Cyber-resilience Test: CIO Guide to Passing DORA Compliance","_yoast_wpseo_metadesc":"TLPT under DORA: Ensure cyber-resilience with real-world attack testing on live systems. Learn how CIOs can comply and strengthen defenses\u2014read now.","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[678],"tags":[],"class_list":["post-14848","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","entry"],"wpml_language":"en","wpml_translation_of":12810,"yoast_head":"\nThe Key Points at a Glance<\/h2>\n
\n
What Sets TLPT Apart from a Normal Penetration Test<\/h2>\n
\n
Who has to carry out TLPT?<\/h2>\n
TIBER-DE: The German framework<\/h2>\n
Preparation: What CIOs Need to Do Now<\/h2>\n
What Happens After the Test<\/h2>\n
Frequently Asked Questions<\/h2>\n
What is the difference between TLPT and a standard penetration test?<\/strong><\/summary>\n
Which financial institutions are required to conduct TLPT?<\/strong><\/summary>\n
How long does a TLPT take?<\/strong><\/summary>\n
What is Purple Teaming?<\/strong><\/summary>\n
Do non-financial companies also have to conduct TLPT?<\/strong><\/summary>\n
Recommended Reading from the Editors<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n
Read more<\/h3>\n
\n