Blog: June 2025 DORA TLPT standard has arrived

Red-team service providers must demonstrate:

• Proven experience conducting TLPTs aligned with frameworks such as TIBER-EU or CBEST.
• Multidisciplinary teams with capabilities in offensive security, threat intelligence, operational security, and social engineering.
• Realistic simulation of advanced persistent threats (APTs), tailored to the entity's specific threat profile.
• Secure tooling and testing infrastructure.
• Documented methodologies aligned to the TLPT lifecycle phases: preparation, threat intelligence, testing, closure, and replay.

To maintain objectivity and avoid conflicts of interest, red-team providers must:

• Operate independently of the entity's internal security functions.
• Avoid other commercial relationships with the entity.
• Undergo external validation.
• Be rotated at least every third TLPT, with at least one external team used during this cycle.

Additional measures include:

• Formal declarations of interest from all red-team personnel.
• No overlap between red and blue team members.
• Contractual safeguards to prevent data misuse.
• Regulator oversight and visibility.

At AMR CyberSecurity, we anticipate the first wave of mandatory TLPT notifications will begin by Q4 2025. Entities that wait for formal requests may find themselves scrambling for red-team capacity.

Those who proactively launch TLPT exercises in line with the standard will be both compliant and more resilient when the next threat strikes.

Although DORA's TLPT standard is a compliance requirement, its ultimate goal is to improve operational resilience across Europe's financial ecosystem.

For details on how AMR CyberSecurity can support your TLPT readiness, contact us at enquiries@amrcybersecurity.com.