Lion Cipher Lab
Scope a threat-led penetration test (TLPT) under DORA and TIBER-EU
- GRC / Compliance
- Advanced
- ~80 min
- Free · no account required
Why it matters
DORA -- Regulation (EU) 2022/2554 -- has applied since 17 January 2025, and its testing pillar is where a lot of financial entities discover their programme is not actually compliant. DORA sets two tiers. Every in-scope entity must run a broad digital operational resilience TESTING PROGRAMME (Articles 24-25): vulnerability assessments, scans, gap analyses, penetration testing and more, on critical ICT systems, at least yearly. On top of that, certain entities identified by their competent authority must perform THREAT-LED PENETRATION TESTING -- TLPT (Articles 26-27) -- at least every three…
What you'll learn
- reading DORA's testing pillar precisely: the baseline testing programme (Art. 24-25) versus the apex TLPT obligation (Art. 26-27), and who is in scope
- scoping a TLPT by Critical or Important Functions (CIFs) and the underpinning LIVE PRODUCTION ICT systems, and defending why production is tested and why narrow scoping is a failure
- mapping the TIBER-EU engagement teams -- Control Team, Threat Intelligence provider, Red Team provider, White Team, and the authority's TLPT Cyber Team -- and the tester independence/competence requirements
- drafting a RACI across those teams and explaining why the trusted Control/White Team must stay tiny (the blue team must NOT know)
- turning targeted threat intelligence into red-team scenarios: picking relevant threat actors, mapping likely TTPs to MITRE ATT&CK, and writing concrete flags, rules of engagement and leg-up mechanisms
- building the closure package: a remediation tracker, the test summary report contents, the attestation to the authority, the 3-year cadence, and the pooled/joint testing option
- the judgment to distinguish a real TLPT from routine vulnerability scanning or a normal pentest, and to know that DORA TLPT is mandatory law where TIBER-EU is a voluntary framework
Steps in this lab
- Where TLPT sits: the apex of DORA's testing pillar
- The framework TLPT is built on: TIBER-EU
- Meet your entity: Meridian Pay (the fictional case)
- Step 1 -- Scope the test: critical functions and production targets
- Step 2 -- Map the teams and their independence rules
- Step 3 -- Targeted threat intelligence into red-team scenarios
- Step 4 -- Closure: remediation, summary report, attestation, cadence
- The judgment: what separates a real TLPT from theatre