DORA TLPT: who must run threat-led penetration tests and how
Threat-led penetration testing (TLPT) is the advanced testing DORA requires from certain financial entities, based on the experience of the TIBER-EU framework. Delegated Regulation (EU) 2025/1190 sets who is in scope, how tests run and what testers must prove.
Posez votre question
Compte gratuit requisLes réponses sont rédigées par un modèle de langage à partir des seuls documents de cette base, avec leurs sources numérotées. Elles peuvent être inexactes et ne constituent pas un conseil juridique, médical ou financier : vérifiez les sources avant toute décision importante.
Entities required to perform TLPT
TLPT authorities require it from, among others, credit institutions identified as G-SIIs or O-SIIs or part of one, central securities depositories, central counterparties and certain trading venues.
Payment institutions are in scope if they exceeded EUR 150 billion of total value of payment transactions in each of the 2 calendar years before the assessment. For electronic money institutions, the test is the same EUR 150 billion, or EUR 40 billion of outstanding electronic money.
Identified entities carry out TLPT at least every 3 years; the competent authority may reduce or increase this frequency.
From red team to purple teaming
The active red team testing phase lasts at least 12 weeks, with testers reporting at least weekly. Within 4 weeks of its end, testers submit the red team test report. No later than 10 weeks after the end, the blue team submits its report and both teams replay the attack, followed by a purple teaming exercise.
Questions fréquentes
What experience must the testing team have?
External testers need a team with at least a manager with 5 years of experience in penetration and red team testing and two additional testers with at least 2 years each. They must provide at least five references from previous assignments.
Can the threat intelligence provider be internal?
No. Testers may be internal or external, but threat intelligence providers are always external. The provider must give at least three references from previous assignments.
Can a TLPT be paused if it becomes risky?
Yes. In exceptional circumstances the control team lead may suspend it, or, as a last resort and with validation by the TLPT authority, continue with a limited purple teaming exercise that counts towards the 12 weeks.
Intégrer / API / MCP
Branchez cette base à Claude, Cursor, ChatGPT ou votre propre application. Chaque requête API ou MCP coûte 0,10 €, débitée de votre crédit Kopik (non facturée si rien n'est trouvé). Il vous faut une clé API : créez-la depuis votre tableau de bord.
MCP pour vos agents
Adresse du serveur MCP de cette base (outils ask_base et search_base) :
https://kopik.io/api/mcp?base=eu-dora-ict-resilienceClaude Code, Cursor et autres clients
claude mcp add --transport http kopik-eu-dora-ict-resilience "https://kopik.io/api/mcp?base=eu-dora-ict-resilience" --header "Authorization: Bearer kpk_…"{
"mcpServers": {
"kopik-eu-dora-ict-resilience": {
"url": "https://kopik.io/api/mcp?base=eu-dora-ict-resilience",
"headers": {
"Authorization": "Bearer kpk_…"
}
}
}
}API REST pour vos applications
mode vaut "answer" (réponse rédigée + sources) ou "passages" (passages bruts seulement). Ajoutez un maxPriceCents facultatif pour plafonner le prix : si la base coûte plus cher, l'appel est refusé sans rien débiter.
curl -X POST https://kopik.io/api/v1/bases/eu-dora-ict-resilience/query \
-H "Authorization: Bearer kpk_…" \
-H "Content-Type: application/json" \
-d '{"question": "Votre question ici", "mode": "answer"}'Pour commencer
- Créez une clé dans votre tableau de bord et rechargez votre crédit.
- Remplacez
kpk_…par votre clé. - Tout le détail (réponses, erreurs, exemples JS et Python) : documentation développeurs.