YTYK You think you know

Card 11 of 15 Testing — and then the hard kind ●●● Sharp edge

Threat-led penetration testing, on production

Entities identified by their authorities must additionally carry out threat-led penetration testing (TLPT) at least every three years, on live production systems supporting critical or important functions — and critical ICT third-party providers must participate where they are in the scope of the test.

Why it is like this

A test against a staging copy proves the staging copy is secure. Requiring live systems, red-teamed against real threat intelligence, is the only way to test the thing that is actually exposed — which is also why the regime is restricted to entities that can survive it.

Not to be confused with

Something every in-scope entity must do. TLPT applies only to those the authorities designate, on the basis of impact, financial stability concerns and risk profile. For everyone else, Articles 24–25 are the whole testing obligation.

In practice

The methodology follows the TIBER-EU framework, and the authority issues an attestation recognised across Member States — so the test is not repeated per country.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 26 and Art. 27. Read on .

Odd one out Check yourself

Three of these are true of TLPT under DORA. Which one is not?

  1. It is carried out at least every three years
  2. It is run against live production systems
  3. Critical ICT third-party providers may be pulled into its scope
  4. Every entity in scope of DORA must perform it
Show the answer

Every entity in scope of DORA must perform it

TLPT applies only to entities identified by the competent authorities. Assuming it applies to you is an expensive mistake in both directions.