TLPT Under DORA: Threat-Led Penetration Testing, CBEST and STAR-FS

TLPT, or threat-led penetration testing, is the intelligence-led red team test of live production systems that the EU’s Digital Operational Resilience Act (DORA) requires of selected financial entities, at least every three years. Article 26 sets the obligation, Article 27 sets the rules for testers, and Commission Delegated Regulation (EU) 2025/1190 sets the method, which follows the ECB’s TIBER-EU framework. In the UK, the closest equivalents are CBEST and STAR-FS.

For DORA as a whole, including the yearly testing in Articles 24 and 25, see our guide to DORA regulation. Sovereign Secure is not a TLPT, CBEST or STAR-FS provider; the last section explains where our testing fits.

What is TLPT?

DORA Article 3(17) defines TLPT as a framework that mimics the tactics, techniques and procedures of real threat actors, delivering a controlled, bespoke, intelligence-led red team test of a financial entity’s critical live production systems. In practice, a threat intelligence provider works out who is most likely to attack the entity and how, then red team testers act out those scenarios against production while the defenders are not told a test is running.

That makes TLPT different from the testing most firms already buy:

Our guide to what red teaming is explains the method TLPT builds on.

Who needs TLPT under DORA?

TLPT applies only to financial entities that their TLPT authority identifies under Article 26(8). Microenterprises and entities under DORA’s simplified ICT risk management framework (Article 16) are outside it. The authority assesses each entity’s impact on the financial sector, financial stability concerns and ICT risk profile.

Article 2 of the 2025 technical standards then sets default categories that authorities must require to test, unless their assessment shows it is not justified:

Authorities can also require TLPT from entities outside these categories. UK-only firms are not in scope, but EU-authorised subsidiaries of UK groups can be, and UK technology suppliers can be drawn in (see below). Firms with UK and EU operations should read this alongside our guide to UK operational resilience.

What do DORA Articles 26 and 27 require?

Article 26 sets how each test runs:

• Frequency: at least every three years, which the authority can shorten or lengthen.
• Scope: several or all critical or important functions, tested on live production systems. The entity proposes the scope and the authority validates it.
• Third parties: ICT third-party service providers supporting those functions are in scope, and the entity stays fully responsible. If a provider’s participation could harm its service to customers outside DORA, or the confidentiality of their data, the entity and provider can agree in writing that the provider contracts an external tester directly for a pooled TLPT covering several financial entities, directed by one of them. Article 30(3)(d) also requires contracts for critical or important functions to oblige the provider to take part.
• Risk management: controls to limit any impact on data, assets and services during testing.
• Reporting: a summary of findings, remediation plans and supporting documentation go to the authority, which issues an attestation that other EU authorities recognise.
• Internal testers: allowed, but external testers must be used every third test, and significant credit institutions supervised by the ECB must use external testers only.

Article 27 sets who can test:

What do the TLPT technical standards require?

Commission Delegated Regulation (EU) 2025/1190, available on EUR-Lex, was adopted on 13 February 2025 and entered into force on 8 July 2025. It follows TIBER-EU’s structure in three phases:

In exceptional circumstances, such as a risk of damage to data, assets or critical services, the control team lead can suspend the test. Test managers from the TLPT authority oversee every phase.

How does TIBER-EU relate to TLPT?

TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) is the ECB framework, first published in May 2018, that DORA Article 26(11) required the technical standards to follow. National authorities, such as De Nederlandsche Bank, run their own TIBER programmes. The ECB has since aligned TIBER-EU with the standards, including their terms, such as “control team” where the original framework said “white team”. TIBER-EU helps authorities and entities meet DORA’s TLPT requirements, but a test only counts as TLPT if it meets Articles 26 and 27 and the standards.

What is the difference between CBEST, STAR-FS and TLPT?

CBEST and STAR-FS are the UK’s threat-led testing schemes, part of the supervisory toolkit of the Bank of England, the PRA and the FCA. The Bank of England’s operational resilience page describes both.

Mutual recognition under DORA works through attestations issued by EU authorities, and nothing in DORA treats a CBEST or STAR-FS test as a TLPT. Groups regulated on both sides should agree their approach with each authority early.

How do standard pentests and red teams prepare a firm for TLPT?

TLPT measures how well a firm detects and responds to a skilled attacker over months. If basic weaknesses, such as exposed services or weak identity controls, are still open, testers reach their objectives quickly and the firm learns little. Regular testing closes those gaps first:

Banks and payment firms often face DORA, PCI DSS and UK rules together; our page on cyber security for banks and card issuers shows how they overlap.

Why Sovereign Secure?

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, Qualified PIN Assessor and Card Production Security Assessor, and ISO 27001 certified. We test web applications, APIs, networks, cloud, mobile apps, hardware, wireless, people, source code and AI systems, run red team assessments and provide vulnerability scanning.

We are not a TLPT, CBEST or STAR-FS provider. Our role comes before the regulated test: finding and fixing the weaknesses an intelligence-led red team would otherwise spend its weeks on.

What should you do next?

If your entity has been identified for TLPT, or expects to be, start with an honest view of your exposure. Request a penetration testing quote for the systems behind your critical or important functions, or call +44 161 523 5276 to discuss a red team assessment ahead of your regulated test.