DORA Threat-Led Penetration Testing (TLPT): Who Must Do It and How TIBER-EU Applies

TLPT vs Ordinary Pentests

• Threat intelligence drives scenarios against critical functions
• Production-scope engagement with purple-team / control validation themes
• Authority involvement and remediation tracking expectations

Preparation Checklist

• Critical-function map and crown-jewel asset inventory
• Board-approved testing policy and safe-engagement rules
• Provider selection (testers + threat intelligence) meeting independence rules
• Remediation ownership before the test starts

TIBER-EU Relationship

TIBER-EU is the widely referenced European framework for threat-led testing. Many authorities expect DORA TLPT programmes to be TIBER-compatible even when local branding differs. Coordinate early with your competent authority.

How CyberSilo Helps

• Pillar-by-pillar evidence maps in CSA for DORA
• Detection and major-incident timelines with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Does every bank need TLPT every year?

Significant entities follow the TLPT obligation on the Regulation’s cycle (commonly three-yearly unless the authority requires otherwise). Other entities still need proportionate digital operational resilience testing.

Is TIBER-EU mandatory by name?

DORA requires TLPT aligned to recognised threat-led methodologies; TIBER-EU is the dominant European reference. Follow your competent authority’s instructions.

Can TLPT replace the whole testing pillar?

No. TLPT is the advanced layer. Entities still need broader vulnerability assessments, scenario tests, and control testing under the digital operational resilience testing chapter.

Related DORA Resources

Hub · Checklist · CSA