DORA Threat-Led Penetration Testing: When Is TLPT Required?

DORA Threat-Led Penetration Testing (TLPT) is mandatory for financial entities identified by their competent authorities under the Digital Operational Resilience Act (DORA). European insurance and reinsurance undertakings are not automatically required to undergo TLPT simply because they fall within DORA's scope. The obligation applies to insurers that meet the relevant regulatory criteria and are selected by the competent authority responsible for TLPT.

Under Article 26 of Regulation (EU) 2022/2554, designated financial entities must perform TLPT at least once every three years, subject to adjustments by the competent authority. The testing must cover several or all critical or important functions and take place on live production systems supporting those functions. Commission Delegated Regulation (EU) 2025/1190, which has applied since 8 July 2025, specifies the criteria for selecting entities, the testing methodology, the requirements for internal testers, and the procedures for completing and closing a TLPT.

For European insurers, the key question is therefore not simply whether DORA applies, but whether the undertaking meets the specific TLPT eligibility criteria and has been identified by its competent authority. Understanding this distinction is essential for determining regulatory obligations, planning testing activities, and managing risks associated with live production environments.

Strengthen digital operational resilience and demonstrate alignment with DORA Requirements. Explore INTERCERT's DORA assessment services today.

What Is DORA Threat-Led Penetration Testing (TLPT)?

DORA Threat-Led Penetration Testing is an advanced cybersecurity testing exercise that simulates realistic attacks based on threat intelligence relevant to a financial entity. Unlike conventional penetration testing, TLPT uses information about actual threat actors, their tactics, techniques, and procedures to examine whether an organisation can prevent, detect, respond to, and recover from sophisticated cyberattacks.

Under DORA, TLPT forms part of the broader digital operational resilience framework. Its purpose is to evaluate the resilience of critical or important functions against realistic cyber threats, including risks arising from interconnected systems and external ICT service providers.

For insurers, these functions may involve policy administration, claims processing, customer portals, underwriting platforms, payment operations, and systems used to manage sensitive policyholder information. The precise scope depends on the functions identified as critical or important and validated by the competent authority.

DORA Regulatory Threat-Led Penetration Testing Explained

DORA establishes the legal obligation for selected financial entities to undergo TLPT, while the associated regulatory technical standards define how the exercise must be performed. Article 26 establishes the core testing obligations, and Article 27 specifies requirements for testers.

Commission Delegated Regulation (EU) 2025/1190 provides further detail on entity selection, testing scope, methodology, internal testers, reporting, remediation, and supervisory cooperation. These requirements make TLPT a structured regulatory exercise rather than an ordinary security test commissioned solely at an organisation's discretion.

The testing process uses threat intelligence to develop realistic attack scenarios relevant to the insurer's technology environment and risk profile. Red team testers then attempt to execute those scenarios against agreed targets within the authorised scope. The exercise is designed to evaluate real-world defensive capabilities while maintaining appropriate safeguards for operational systems.

How TLPT Differs from Standard Penetration Testing

Standard penetration testing generally examines specified applications, networks, APIs, infrastructure, or other technology assets to identify and validate security weaknesses. It can be an important part of an insurer's cybersecurity programme, but it does not automatically meet the requirements for DORA TLPT.

TLPT is broader in its regulatory purpose and testing methodology. It uses threat intelligence tailored to the entity, focuses on critical or important functions, and takes place on live production systems supporting those functions. It also includes prescribed supervisory involvement, testing phases, closure activities, and remediation arrangements.

A conventional vulnerability assessment or penetration test should not be treated as equivalent to TLPT merely because it includes realistic attack techniques. An insurer subject to Article 26 must meet the specific requirements of DORA and the applicable regulatory technical standards.

Why TLPT Matters for European Insurers

European insurers depend on interconnected digital systems to manage customer information, calculate premiums, process claims, execute payments, and maintain business operations. A successful cyberattack against a critical system can affect policyholders, business partners, service availability, and confidence in the wider financial sector.

Threat-led penetration testing evaluates how an insurer's security controls perform against realistic adversarial activity. It can reveal weaknesses in detection, escalation, access controls, incident handling, and coordination between technology teams that may not become apparent through routine security testing.

TLPT also has a regulatory dimension. For an insurer formally identified as subject to the requirement, completing the exercise in accordance with DORA is a legal obligation. The exercise must be planned around operational risks, particularly because testing takes place on production systems rather than being limited to an isolated test environment.

When Is TLPT Required Under DORA?

TLPT is required when a financial entity is identified by the competent authority in accordance with Article 26 of DORA and the applicable regulatory technical standards. The selection process considers factors such as the entity's impact on the financial sector, its systemic importance, its ICT risk profile, and its level of ICT maturity.

European insurers must distinguish between being subject to DORA generally and being selected for advanced threat-led testing. DORA establishes digital operational resilience testing obligations for a wider group of financial entities, while mandatory TLPT applies to entities identified through the specific selection process.

An insurer should therefore review the relevant regulatory criteria, its supervisory status, and any formal communication from its competent authority before concluding that TLPT is mandatory.

DORA Threat-Led Penetration Testing Requirements at a Glance

The main requirements arise from Article 26, Article 27, and Commission Delegated Regulation (EU) 2025/1190.

Identified entities must conduct TLPT at least every three years unless the competent authority requires a different frequency. The test must cover several or all critical or important functions and take place on live production systems supporting those functions. The scope must be based on the entity's assessment and validated by the competent authority.

Testers must meet the prescribed suitability, technical capability, independence, assurance, and insurance requirements. Internal testers are permitted only under specified conditions, including competent authority approval and an external threat intelligence provider.

The exercise must also include appropriate risk controls, cooperation with relevant ICT third-party service providers where they are in scope, and the required reporting and remediation activities. The competent authority provides an attestation when the test is shown to have been conducted in accordance with the applicable requirements.

DORA TLPT Applicability for Financial Entities

DORA covers multiple categories of financial entities, including insurance and reinsurance undertakings. However, Article 26 does not impose identical TLPT obligations on every entity within the broader DORA framework.

Certain categories of financial entities are excluded from the mandatory TLPT population under Article 26, including entities referred to in Article 16(1), first subparagraph, and microenterprises. Other financial entities may be selected according to the applicable criteria and supervisory process.

For insurers, eligibility must be evaluated using the specific provisions for insurance and reinsurance undertakings in the TLPT regulatory technical standards. General assumptions based on company size, market presence, or DORA applicability alone are insufficient to establish whether an individual insurer must undergo testing.

Entities Not Subject to TLPT Under DORA

An insurer is not automatically subject to mandatory TLPT simply because it is regulated under DORA. Undertakings that are not identified by the competent authority for TLPT are not subject to the Article 26 testing obligation solely on the basis of their general DORA status.

However, not being selected for TLPT does not remove an insurer's other applicable digital operational resilience obligations. These can include ICT risk management, incident reporting, digital operational resilience testing, and the management of ICT third-party risks.

Microenterprises are treated differently under the broader testing requirements, and Article 26 excludes them from its mandatory TLPT obligation. The precise classification of an undertaking and the applicability of other DORA provisions should be established using the relevant legal definitions rather than assumptions about its workforce or revenue alone.

DORA Article 26 TLPT Requirements

Article 26 of DORA establishes the principal obligations for advanced testing of ICT systems and processes through TLPT. It requires designated financial entities to conduct testing at least every three years, subject to any frequency adjustment requested by the competent authority.

The article also establishes requirements for live production testing, third-party participation, risk management, regulatory reporting, attestation, and tester selection. These provisions are particularly relevant to insurers because testing may involve systems that process policyholder data or maintain essential insurance operations.

Commission Delegated Regulation (EU) 2025/1190 specifies how the statutory requirements are applied throughout the TLPT lifecycle, from entity identification and preparation to active testing, closure, and remediation.

Advanced Testing Obligations for Financial Entities

Financial entities identified for TLPT must conduct a threat-led exercise that follows the prescribed regulatory methodology. The exercise must be based on targeted threat intelligence and test the resilience of the entity's critical or important functions against realistic attack scenarios.

The testing process includes preparation, threat intelligence gathering, red team testing, closure, and remediation planning. It also involves designated test managers from the relevant TLPT authority, the financial entity's control team, testers, and an external threat intelligence provider.

An insurer must establish appropriate organisational arrangements before testing begins. This includes defining responsibilities, agreeing on the testing scope, identifying relevant risks, and maintaining suitable controls to prevent unacceptable disruption to business operations.

Testing of Critical or Important Functions

TLPT must cover several or all critical or important functions selected for the exercise. Under Article 26, the testing must take place on live production systems that serve those functions.

For an insurer, relevant functions may include claims processing, underwriting, policy administration, customer account management, payment processing, and essential data services. These are examples rather than a fixed list of functions that every insurer must include.

The insurer must identify the ICT systems, processes, and technologies associated with its selected functions. Its assessment determines the proposed testing scope, which must be validated by the competent authority. The scope should reflect the importance of each function, the relevant threat scenarios, and the operational risks associated with testing.

Role of Third-Party ICT Service Providers in TLPT

Insurance companies frequently rely on external ICT providers for cloud infrastructure, data hosting, claims platforms, identity management, and other technology services. If these services are relevant to the critical or important functions included in a TLPT, the associated third-party arrangements must be considered during scoping.

Article 26 requires financial entities to take the necessary measures and safeguards to secure the participation of ICT third-party service providers included in the test. The insurer remains fully responsible for compliance with DORA, even when part of its technology environment is operated by an external provider.

Contracts, testing permissions, escalation procedures, and operational risk controls should therefore be considered before the active testing phase. These arrangements are important where a shared service is used by several financial entities or where an attack scenario could affect systems beyond the insurer's own environment.

Competent Authority Oversight and Attestation

The competent authority plays a central role in the TLPT process. Its responsibilities include identifying financial entities subject to testing, validating relevant scope decisions, overseeing prescribed testing activities, and evaluating whether the exercise meets regulatory requirements.

After testing, the financial entity and, where applicable, external testers must provide the required summary of findings, remediation plans, and evidence demonstrating that the exercise complied with the regulation. The relevant authority issues an attestation when the required conditions have been met.

Attestation confirms that the test was performed in accordance with the applicable requirements. It does not remove the insurer's responsibility for addressing identified weaknesses, managing operational risks, or meeting its wider DORA obligations.

DORA Article 26 and 27 Penetration Testing: Tester Requirements

Articles 26 and 27 establish requirements for the people and organisations carrying out TLPT. The objective is to ensure that testing is performed by suitably qualified and independent professionals with the expertise required for realistic threat-led exercises.

Insurers must distinguish between selecting a conventional penetration testing provider and appointing a team that meets the specific requirements for DORA TLPT. Technical testing capability alone does not establish regulatory suitability.

Requirements for External Testers

Article 27 requires testers to meet defined standards of suitability and reputation, technical and organisational capability, and expertise in threat intelligence, penetration testing, and red team testing. Testers must also meet the applicable certification or formal code of conduct requirements.

They must provide independent assurance or an audit report relating to the sound management of risks associated with the exercise, including the protection of confidential information and appropriate arrangements for business risks. Relevant professional indemnity insurance must cover risks such as misconduct and negligence.

Commission Delegated Regulation (EU) 2025/1190 also establishes requirements for selecting TLPT providers. The insurer should verify the provider's actual experience with intelligence-led red team exercises in financial services, rather than relying solely on general penetration testing experience or marketing claims.

The contractual arrangements must also address the secure handling of test results and any related data processing. This includes the creation, storage, aggregation, reporting, communication, and destruction of sensitive information.

Requirements for Internal Testers

DORA permits the use of internal testers, but only when the prescribed conditions are met. The arrangement must receive approval from the relevant competent authority, which must verify that sufficient dedicated resources are available and conflicts of interest are avoided throughout the design and execution of the test.

The threat intelligence provider must be external to the financial entity. Internal testers must also satisfy the applicable requirements for TLPT providers and the more specific conditions established by the regulatory technical standards.

Internal testing is therefore not an automatic exemption from the provider requirements. Insurers considering this approach should establish the proposed team's qualifications, independence arrangements, organisational separation, and regulatory approval before the exercise begins.

Article 26 also requires financial entities using internal testers to contract external testers for every third TLPT. This means an insurer cannot rely exclusively on internal testing indefinitely.

Independence, Insurance, and Professional Standards for Testers

Independence is important because TLPT evaluates the effectiveness of an organisation's security controls. Testers must be able to examine attack paths and identify weaknesses without conflicts of interest compromising the exercise.

Financial entities should verify the relevant qualifications, technical expertise, organisational arrangements, insurance coverage, and professional standards of proposed providers. Where a provider also delivers other services to the insurer, appropriate separation of personnel and responsibilities may be necessary.

The insurer should also establish contractual controls for confidentiality, data handling, permitted testing activities, escalation, and the management of unexpected operational effects. These arrangements are particularly important when the exercise involves live systems and sensitive policyholder information.

DORA TLPT Mandatory Criteria for Insurers

DORA TLPT eligibility for insurers is determined through a regulatory selection process rather than a universal rule that applies to every insurance company. Commission Delegated Regulation (EU) 2025/1190 specifies the criteria authorities use when identifying financial entities that must undergo testing.

The assessment considers the insurer's impact on the financial sector, systemic importance, and ICT risk profile. Quantitative criteria also apply to insurance and reinsurance undertakings under the regulatory technical standards.

Meeting quantitative thresholds does not mean that an insurer must automatically undergo TLPT in every case. The competent authority must apply the relevant selection criteria and consider whether testing is justified in light of the entity's overall characteristics and risks.

DORA TLPT Requirements for Insurance Companies

The regulatory technical standards establish a specific selection process for insurance and reinsurance undertakings. Under Article 2 of Commission Delegated Regulation (EU) 2025/1190, authorities assess insurance and reinsurance undertakings against the criteria set out in Article 1(2)(g).

The initial quantitative criteria include gross written premiums exceeding EUR 1.5 billion and technical provisions exceeding EUR 10 billion. For life insurance undertakings and undertakings pursuing both life and non-life activities, the criteria also include total assets exceeding 3.5% of the aggregate total assets of insurance and reinsurance undertakings established in the relevant Member State.

The authority then identifies a subset of undertakings from those meeting the initial criteria. Within that subset, the additional criteria include gross written premiums exceeding EUR 3 billion, technical provisions exceeding EUR 30 billion, or total assets exceeding 10% of the relevant national aggregate total assets.

These thresholds must be interpreted together with the detailed legal provisions and the authority's assessment. An insurer should not conclude that it is automatically subject to TLPT merely because it meets one financial threshold, nor assume that it is exempt because it falls below a particular threshold without reviewing the applicable regulatory process.

Criteria Used to Identify Insurers Subject to TLPT

The selection process considers both quantitative thresholds and broader indicators of systemic importance and ICT risk. Relevant factors include the insurer's size, the nature of its services, its interconnectedness with other financial entities, the complexity of its business model, and the extent to which its services can be replaced by other providers.

Authorities also examine ICT-related characteristics, including the entity's risk profile, threat landscape, dependence on technology, architecture complexity, and reliance on external ICT service providers. The maturity of incident detection, mitigation, business continuity, and recovery arrangements may also inform the assessment.

These factors allow authorities to evaluate whether a threat-led exercise is proportionate and justified for the specific undertaking. They also recognise that the consequences of a major technology disruption can vary significantly between insurers, even where some financial indicators are similar.

Role of Competent Authorities in Selecting Entities

The relevant TLPT authority determines which financial entities are required to undergo testing under the applicable framework. Depending on the national arrangements, this may be the competent supervisory authority, a designated public authority, or another authority entrusted with the relevant tasks.

For insurers, the selection process should not be treated as a self-certification exercise based solely on internal calculations. The organisation should monitor regulatory communications, maintain accurate information about its business and ICT risk profile, and establish who is responsible for TLPT-related matters in its jurisdiction.

Where the insurer is uncertain about its status, the appropriate course is to seek clarification from the relevant authority rather than infer that the obligation applies or does not apply based only on size.

DORA Threat-Led Penetration Testing Eligibility Criteria

The eligibility process combines the impact of a financial entity, its systemic character, and its ICT risk profile. This approach reflects the purpose of TLPT: to concentrate advanced, operationally demanding testing on financial entities for which realistic attack simulation is justified.

For European insurers, the assessment is not limited to premium income or total assets. Technology dependence, market position, operational complexity, and interconnectedness can also affect how the authority evaluates the entity.

Impact-Related Factors

Impact-related factors examine the insurer's significance to the financial sector. Authorities may consider the size of its operations, the Member States in which it provides services, its market position, the range of activities it offers, and the importance of those services to the wider financial system.

The substitutability of the insurer's services is also relevant. If a major disruption would be difficult for other market participants to absorb, the consequences may be more significant than those associated with an entity whose services can readily be replaced.

Business model complexity and the relationship between different operations may also influence the assessment. For example, an insurer operating across several markets with interconnected digital platforms may have a different operational risk profile from an undertaking with a more limited business structure.

Systemic Character and Financial Stability Considerations

Systemic importance concerns the potential consequences of a disruption for the financial sector at national or European Union level. Authorities consider the insurer's relationships with other financial entities, its role in important market activities, and the potential effects of a major operational failure.

The assessment can also consider whether the insurer belongs to a financial group that shares ICT systems or has systemic importance. Shared technology can create dependencies that extend beyond an individual legal entity.

A major incident affecting a highly interconnected insurer could disrupt claims processing, payments, policy administration, or services used by other financial organisations. These potential consequences are relevant when authorities determine whether advanced testing is appropriate.

ICT Risk Profile and Maturity Considerations

The ICT risk assessment examines how technology-related risks could affect the insurer's critical or important functions. Factors include the threat landscape, complexity of the ICT architecture, dependence on technology, and the number and type of arrangements with external or intra-group ICT providers.

Authorities may also consider the maturity of security monitoring, incident detection, mitigation, business continuity, and recovery arrangements. Relevant supervisory findings can inform the assessment of the entity's ICT maturity.

A complex environment with significant technology dependencies may present a different testing requirement from a simpler environment. However, ICT maturity alone does not determine TLPT applicability. The authority evaluates the relevant criteria together when deciding whether the undertaking should be selected.

DORA Critical Financial Entities TLPT Requirements

TLPT is intended for financial entities whose characteristics justify advanced threat-led testing. In the insurance sector, the identification process considers quantitative eligibility criteria alongside factors related to systemic importance, business impact, and technology risk.

The distinction between a critical financial entity in general industry terminology and an entity formally identified for DORA TLPT is important. Insurers should establish their regulatory status through the applicable selection process rather than relying on an informal label.

How Critical Financial Entities Are Identified

Competent authorities assess the relevant financial entities against the criteria established by DORA and Commission Delegated Regulation (EU) 2025/1190. For insurers, this includes the specific quantitative criteria for insurance and reinsurance undertakings, together with the wider assessment of impact, systemic character, and ICT risk.

Authorities can also consider whether a financial entity's shared technology environment or group structure makes an entity-level or joint testing arrangement more appropriate. Meeting a quantitative threshold is an important part of the process, but it should not be treated as an automatic confirmation of TLPT applicability.

Insurers should maintain a clear record of their regulatory classification, relevant financial indicators, ICT dependencies, and supervisory communications. These records can make it easier to establish the organisation's position when a TLPT authority requests information.

Additional Expectations for Critical or Important Functions

For an insurer selected for TLPT, the exercise must examine several or all critical or important functions included in the validated scope. The related technology systems, processes, and dependencies must be identified before active testing begins.

Testing should reflect realistic threats to those functions, including the ways an attacker could gain initial access, move through connected systems, and attempt to reach agreed objectives. The exercise also evaluates the organisation's ability to identify and respond to adversarial activity.

Because the test takes place on live production systems, the insurer must establish risk controls, escalation procedures, and clear responsibilities before execution. Testing should be designed to generate meaningful evidence without creating unacceptable risks to policyholder services or the wider financial sector.

DORA TLPT Scope and Eligibility for Insurers

TLPT scope determines which critical or important functions, ICT systems, processes, and technologies are examined during the exercise. For insurers, scope definition must reflect the organisation's operational dependencies, relevant threat scenarios, and the requirements of the competent authority.

Eligibility and scope are separate questions. Eligibility determines whether an insurer is required to undergo TLPT, while scoping establishes which functions and technology assets are included once the exercise is required.

Defining Critical or Important Functions in Scope

The insurer must identify the critical or important functions selected for testing and the technology environment associated with them. The assessment should consider the importance of each function to the insurer and the wider financial sector, including its operational and economic significance.

Potential functions include claims settlement, policy administration, underwriting, customer identity management, premium collection, and essential payment services. The actual scope depends on the insurer's business model and the functions validated for the exercise.

The insurer should also identify the dependencies between these functions. A claims platform, for example, may depend on identity services, cloud infrastructure, external data providers, and payment systems. Understanding these relationships helps establish realistic attack scenarios and define the boundaries of the test.

Live Production Systems and Underlying ICT Services

Article 26 requires TLPT to be conducted on live production systems that serve the selected critical or important functions. This is a defining characteristic of regulatory TLPT and distinguishes it from exercises restricted to isolated test environments.

Live testing creates operational risks that must be assessed before execution. A simulated attack could affect system availability, expose sensitive information, alter data, or disrupt interconnected services if appropriate safeguards are not established.

The insurer must therefore define permitted testing activities, escalation procedures, communication channels, and risk mitigation measures. The control team and relevant test managers should maintain oversight of the exercise in accordance with the applicable requirements.

Scoping Involvement of ICT Third-Party Providers

External technology services can form an important part of an insurer's critical operations. If a selected function depends on a cloud platform, hosted application, data processing service, or other ICT third-party arrangement, the dependency must be considered when defining the TLPT scope.

The insurer should identify the relevant contracts, technical dependencies, permissions, and operational restrictions before the testing phase. Where a third-party provider is included in the test, the insurer must establish the necessary arrangements for participation and risk management.

The use of an external provider does not transfer the insurer's regulatory responsibility. The insurer remains accountable for meeting the applicable TLPT requirements and must ensure that testing arrangements do not create unacceptable risks for the provider or other customers.

Pooled Testing for Shared ICT Providers

DORA permits pooled TLPT arrangements in specified circumstances involving critical ICT third-party service providers. This approach can be relevant when several financial entities depend on the same provider and coordinated testing is appropriate.

Pooled testing must follow the regulatory conditions, including requirements concerning the designated financial entity, the number of participating entities, and the management of risks arising from the shared environment. The scope must reflect the complexity and types of services involved.

A pooled exercise is not a blanket exemption from individual regulatory responsibilities. Each participating insurer remains responsible for complying with DORA, and the relevant authorities must be involved as required by the applicable rules.

DORA TLPT Testing Frequency Requirements

DORA establishes a minimum TLPT frequency of once every three years for financial entities identified under Article 26. However, the three-year period should not be interpreted as an unconditional schedule that every insurer can apply without considering its supervisory position.

The competent authority may require testing to take place more or less frequently, taking account of the entity's risk profile and operational circumstances. The applicable regulatory technical standards also establish requirements for planning, conducting, and closing each exercise.

Three-Year Testing Cycle Under DORA

Article 26(1) establishes the minimum three-year testing cycle for entities selected for TLPT. The applicable regulatory technical standards define the process that entities and authorities follow when organising the exercise.

An insurer should maintain a testing schedule that reflects its regulatory obligations, prior TLPT activities, current supervisory communications, and relevant changes in its ICT environment. The organisation should not assume that completing a previous penetration test automatically establishes the date or validity of its next DORA TLPT.

The three-year requirement concerns the prescribed TLPT exercise, not every type of cybersecurity test. Vulnerability assessments, application penetration tests, and other digital operational resilience tests may have separate schedules under the insurer's wider regulatory obligations and risk management programme.

Factors That Adjust Testing Frequency

The competent authority may adjust TLPT frequency based on the insurer's risk profile and operational circumstances. Relevant considerations can include material changes in the ICT environment, significant changes to critical functions, evolving cyber threats, and supervisory findings.

An insurer should review whether major technology changes, acquisitions, outsourcing arrangements, or changes to its threat exposure affect its testing programme. These developments do not automatically trigger a new TLPT in every case, but they may be relevant to the authority's decision on testing frequency or scope.

The organisation should obtain confirmation from the relevant authority where the timing or extent of its next exercise is unclear.

Re-Testing and Remediation Follow-Up

TLPT does not end when the red team completes its attack scenarios. The closure phase includes review of the results, replay activities, collaborative purple teaming, and the preparation of remediation plans in accordance with the applicable regulatory technical standards.

The insurer must evaluate identified weaknesses and determine appropriate corrective measures, responsibilities, and completion timelines. Remediation should be prioritised according to the potential impact on critical functions, the severity of the identified weaknesses, and the associated operational risks.

The regulatory process also requires the relevant findings, remediation plans, and evidence of compliance to be provided to the competent authority. Attestation of the completed test does not mean that every identified weakness has been eliminated or that the insurer's wider regulatory obligations have ended.

DORA TIBER-EU Framework for Insurers

The TIBER-EU framework is the methodological basis for DORA TLPT. Commission Delegated Regulation (EU) 2025/1190 was developed in accordance with TIBER-EU and incorporates the applicable requirements into a binding regulatory framework.

Insurers subject to TLPT may use TIBER-EU or a national version of the framework where it is consistent with Articles 26 and 27 of DORA and the applicable regulatory technical standards. The binding DORA requirements take precedence where a framework or national approach differs from the regulation.

TIBER-EU as the Basis for DORA TLPT

TIBER-EU stands for Threat Intelligence-Based Ethical Red Teaming. It provides a structured approach to testing an organisation's resilience against realistic, intelligence-led cyberattacks.

Under DORA, the methodology is adapted to meet specific legal obligations relating to entity selection, tester qualifications, supervisory involvement, scope, testing phases, remediation, and attestation.

Using a TIBER-EU methodology does not automatically establish compliance. An insurer must ensure that the exercise satisfies the applicable DORA requirements and any relevant national procedures.

Phases of a TIBER-EU-Aligned Test

A DORA TLPT generally involves preparation, threat intelligence gathering, active red team testing, and closure. The regulatory technical standards establish the activities and evidence required throughout these phases.

During preparation, the insurer establishes the control team, agrees on the scope, identifies relevant risks, and coordinates with the TLPT authority and selected providers. The threat intelligence provider then examines relevant threats and potential attack surfaces to develop realistic scenarios.

During active testing, the red team executes the approved attack scenarios against live production systems within the agreed scope. The closure phase includes review and replay of the exercise, collaboration between the red and blue teams, purple teaming, and the preparation of the required reports and remediation plans.

Under the regulatory technical standards, the active red team testing phase must be allocated at least 12 weeks. The overall duration of the exercise can vary according to scope, complexity, resources, and the number of parties involved.

Roles of White Team, Threat Intelligence Provider, and Red Team

In TIBER-EU terminology, the white team manages and controls the exercise while maintaining the confidentiality required for realistic testing. Under the DORA regulatory technical standards, the corresponding role is described through the control team and the relevant test managers.

The threat intelligence provider is external to the financial entity and develops targeted intelligence about relevant threat actors, attack surfaces, and realistic attack scenarios. The red team uses this intelligence to test the insurer's defences against agreed objectives.

The blue team consists of personnel responsible for defending the organisation's ICT environment and is generally kept unaware of the planned or ongoing exercise to preserve realism. During closure, the red and blue teams review the results and participate in purple teaming to examine the attack paths and defensive responses.

These roles have different responsibilities, and their separation is important for maintaining test confidentiality, operational control, and the integrity of the findings.

Mutual Recognition of TLPT Across EU Member States

DORA establishes a mechanism for mutual recognition of TLPT between competent authorities. After an exercise has been conducted in accordance with the applicable requirements, the relevant authority can issue an attestation confirming that the test meets the prescribed conditions.

This mechanism is important for insurers operating across several EU Member States. It can reduce the need for duplicative TLPT exercises where a valid test is recognised by the relevant authorities.

Mutual recognition does not mean that every penetration test, prior red team exercise, or TIBER-EU engagement is automatically accepted. The test must satisfy the applicable DORA requirements, and the relevant regulatory process must be followed.

DORA Threat-Led Penetration Testing Compliance Requirements

DORA TLPT compliance involves more than completing a technical attack simulation. Insurers must follow the prescribed process, maintain suitable risk controls, engage qualified providers, retain relevant evidence, and complete the required reporting and remediation activities.

The regulatory technical standards establish detailed expectations for each phase of the exercise. The insurer should coordinate the process with the competent authority and ensure that relevant business, technology, risk, and security stakeholders understand their responsibilities.

Preparation, Testing, and Closure Phases

The preparation phase establishes the organisational arrangements for TLPT. It includes defining the scope, assigning responsibilities, preparing the project charter, selecting suitable providers, and establishing the risk management measures needed for the exercise.

During the testing phase, the threat intelligence provider develops the targeted threat intelligence report, and the red team prepares and executes the testing plan. The exercise must remain within the approved scope and follow the agreed safeguards for live production systems.

The closure phase includes the review and replay of testing activities, collaboration between the red and blue teams, purple teaming, and the preparation of required reports. The insurer must also establish remediation plans for identified findings and complete the applicable regulatory reporting process.

Reporting, Remediation Plans, and Attestation

At the end of the exercise, the insurer and, where applicable, the external testers must provide the competent authority with a summary of relevant findings, remediation plans, and evidence demonstrating that the test complied with the regulatory requirements.

The remediation plan should identify the weaknesses requiring action, the measures selected to address them, and the relevant responsibilities and timelines. The insurer should prioritise findings based on their potential impact on critical or important functions and the wider ICT risk environment.

The authority issues an attestation when the required evidence establishes that the test was performed in accordance with the applicable rules. The insurer remains responsible for managing the identified risks and completing its obligations under DORA.

Evidence and Records Insurers Must Retain

Insurers should maintain a clear record of the TLPT process, including the approved scope, project charter, relevant threat intelligence and testing reports, risk management decisions, closure records, remediation plans, and regulatory communications.

The precise records required depend on the applicable regulatory provisions and the stage of the exercise. The organisation should also maintain appropriate controls over confidential information generated during testing, including access restrictions, secure storage, retention, communication, and destruction.

Well-organised evidence allows the insurer to demonstrate that the required process was followed and that identified weaknesses are being managed. Records should be maintained in accordance with applicable regulatory requirements and the organisation's information security policies.

Common Challenges for Insurers Preparing for TLPT

European insurers can face operational and regulatory challenges when determining whether TLPT applies and planning an exercise that involves live production systems. These challenges often involve unclear eligibility assumptions, complex technology dependencies, and coordination between internal teams, external providers, and regulators.

Addressing these issues requires early review of the insurer's regulatory status, clear ownership of testing activities, and careful planning of the scope and operational safeguards.

Determining Whether TLPT Applies

An insurer may incorrectly assume that DORA automatically requires every regulated insurance company to conduct TLPT. Another common mistake is to assume that meeting a financial threshold guarantees selection or that falling below one threshold establishes an exemption.

The correct approach is to review the applicable quantitative criteria, the broader selection factors, and any relevant communication from the TLPT authority. The insurer should distinguish between general DORA applicability and formal identification for advanced testing.

Managing Risk to Live Production Systems

Testing live systems creates risks that are not present to the same extent in isolated test environments. Uncontrolled activity could affect service availability, alter data, expose confidential information, or disrupt business operations.

Insurers should establish the authorised scope, risk mitigation measures, escalation channels, and decision-making responsibilities before testing begins. The control team must coordinate the exercise with the relevant authority and providers in accordance with the regulatory requirements.

Coordinating with ICT Third-Party Providers

Insurers often depend on external providers for infrastructure, applications, data processing, and other technology services. Coordinating testing across these arrangements can be challenging when contractual permissions, shared systems, or service availability restrictions are involved.

The insurer should identify the relevant providers early, determine which dependencies fall within scope, and establish the necessary contractual and operational arrangements. Where a shared ICT provider is involved, the insurer should also consider whether pooled or joint testing is appropriate under the applicable DORA provisions.

TLPT Readiness Checklist for European Insurers

An insurer can prepare for a potential TLPT by reviewing its regulatory status, critical functions, ICT dependencies, provider arrangements, and testing governance. The checklist below is a practical planning aid and does not replace the legal criteria or a formal decision by the competent authority.

Key Questions to Confirm TLPT Applicability

Before planning a mandatory TLPT, an insurer should establish whether it has been identified by the relevant authority and whether the applicable regulatory criteria have been assessed. It should also confirm which national authority is responsible for TLPT-related matters and whether any supervisory communication establishes specific requirements.

The organisation should review the relevant financial thresholds, its systemic importance, its ICT risk profile, and its dependence on third-party services. Where the insurer's status is unclear, it should obtain clarification from the competent authority rather than relying on an internal assumption.

Key Steps Before Engaging Testers

Before engaging testers, the insurer should confirm its regulatory status, establish the internal control team, identify critical or important functions, and map the relevant technology dependencies. It should determine which external ICT providers may need to participate and establish the operational safeguards required for live production testing.

The insurer should also verify the proposed providers' qualifications, experience, independence, insurance coverage, and contractual arrangements. If internal testers are being considered, the organisation must establish whether the regulatory approval and other conditions for their use can be met.

Finally, the insurer should plan for reporting, remediation, evidence retention, and closure activities before the exercise starts. These activities are part of the overall TLPT process, not administrative tasks to be considered only after testing is complete.

Prepare your financial organization to demonstrate DORA Compliance and operational resilience. Contact INTERCERT to discuss your assessment requirements.

Why Choose INTERCERT for DORA-Related Cybersecurity Assurance

INTERCERT provides independent certification, audit, assessment, and assurance services for organisations operating in regulated and technology-intensive sectors. For financial entities reviewing their cybersecurity assurance needs, INTERCERT's relevant services can be explored in the context of the organisation's applicable regulatory obligations and assurance objectives.

Insurers should first establish whether DORA TLPT applies to their undertaking and identify the requirements set by the relevant authority. Where an independent assessment or assurance service is appropriate, the scope and service should be confirmed against the specific regulatory requirement. DORA TLPT itself must be performed by providers and under arrangements that meet the applicable Articles 26 and 27 requirements.

Read More:
How Does DORA Impact Insurance Companies? Explained in Detail
DORA TLPT and TIBER-EU: Preparing Financial Entities