What is threat-led penetration testing (TLPT)?

How it differs from a penetration test

A standard penetration test checks a defined set of systems for weaknesses, usually with the security team aware of it. TLPT starts from threat intelligence about who is likely to attack this organisation and how. A red team then attempts those attacks against live production systems supporting critical or important functions, with only a small control team aware that a test is running. The aim is to test detection and response as well as prevention.

The scope can include ICT third-party service providers that support those functions. Where a provider’s participation could affect its other customers, the provider and the financial entity can agree to a pooled test, run by an external tester under the direction of one designated financial entity.

TLPT under DORA

Article 26 of DORA sets the requirement. Competent authorities identify which financial entities must carry out TLPT, and can change the three-year frequency for an entity based on its risk profile. When a test is complete, the authority issues an attestation that it met the requirements, which helps other authorities recognise it. The detailed method is set out in regulatory technical standards developed in line with the TIBER-EU framework.

Article 27 sets the rules for the testers themselves.

• Suitability. Testers must be of the highest suitability and reputability, with expertise in threat intelligence, penetration testing and red teaming.
• Accreditation. They must be certified by an accreditation body in a member state, or follow formal codes of conduct or ethical frameworks.
• Insurance. They must hold professional indemnity insurance, including cover for misconduct and negligence.
• Internal testers. Allowed only with the competent authority’s approval and under further conditions. External testers must run every third test, and significant credit institutions must always use external testers.

Preparing for a TLPT

A TLPT runs over several months and involves senior management, the control team, a threat intelligence provider and the testers. Before it starts, agree the scope with the authority, decide how the test will be paused or stopped if it threatens live services, and keep the control team small and bound to confidentiality.

After the test, findings go into a remediation plan with owners and dates. The entity then gives the authority a summary of the findings, the remediation plans and documentation showing the test was carried out as required.

Related terms

Penetration test

An authorised, simulated attack on systems to find weaknesses an attacker could exploit. Most frameworks expect one at least once a year and after significant changes.

CAPA

Corrective and preventive action: the plan, owner and due date attached to an audit finding or incident, tracked until the fix is confirmed and the cause addressed.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.