Search every question across sub-FAQs

Delegated Regulation 2025/1190 starts from the financial entity's impact, systemic character, and ICT risk profile. It points the TLPT authority to impact-related factors such as size, cross-border services, interconnectedness, criticality, substitutability, business-model complexity, and whether the entity belongs to a systemic group sharing ICT systems.

It also points to ICT-risk factors such as the entity's threat landscape, dependence of critical or important functions on ICT, ICT architecture complexity, use of ICT third-party or intra-group providers, supervisory review outcomes, business-continuity maturity, response-and-recovery maturity, and real-time monitoring, detection, analysis, and response capability.

Selection starts a supervised preparation process before the red-team exercise. After notification from the TLPT authority, the financial entity must initiate TLPT and submit initiation information within 3 months. That information includes a project charter, control team lead contact details, intended use of internal or external testers, communication channels, and a code name.

The financial entity must then submit a scope specification document within 6 months of the authority notification. The management body approves the scope specification document, and the TLPT authority approves it if it is complete and supports an appropriate and effective TLPT.

The scope record should explain why each critical or important function and supporting ICT system is included or excluded. Annex II to Delegated Regulation 2025/1190 requires the scope specification to list all critical or important functions identified by the financial entity and, for included functions, the relevant ICT systems, outsourcing status, ICT third-party provider, jurisdictions, and preliminary flags.

Provider selection also needs evidence. The control team must assess testers and threat intelligence providers against DORA Article 27 and the RTS requirements before contracting, provide evidence to test managers, and not proceed where the TLPT authority concludes that the selected providers or testers do not comply with the applicable requirements.

A selected entity should preserve both selection evidence and testing evidence. Selection evidence explains why the entity was identified, who the authority contact was, what scope was approved, and whether the test was individual, joint, or pooled. Testing evidence shows that the authority-supervised process was completed and that remediation is owned.

The active red team testing phase must last at least 12 weeks. After testing, the RTS requires red team and blue team reports, replay and purple teaming activities, a test summary report, remediation plans, and an attestation. The attestation is for mutual recognition and does not remove the financial entity's responsibility for the test impact or remediation.

DORA Article 4 says financial entities must implement ICT risk management rules proportionately, taking into account their size and overall risk profile and the nature, scale, and complexity of their services, activities, and operations. The same proportionality lens also applies to ICT-related incident management, digital operational resilience testing, and ICT third-party risk management where the relevant chapters provide for it.

A smaller, lower-complexity entity may justify simpler governance, fewer layers of documentation, less extensive testing within the applicable programme, or less complex supplier oversight than a large systemic entity. The entity must still meet express duties and minimum frequencies, including annual testing of ICT systems and applications supporting critical or important functions where Article 24 applies. The justification must be tied to the entity's ICT risk facts.

DORA Article 16 replaces Articles 5 to 15 with a simplified ICT risk management framework for specified categories: small and non-interconnected investment firms, exempted payment institutions, specified exempted institutions under Directive 2013/36/EU, exempted electronic money institutions, and small institutions for occupational retirement provision. Size by itself is not an eligibility test; the entity must fit one of those legal categories.

The simplified framework is still a real framework. These entities must maintain documented ICT risk management, monitor ICT systems, protect availability, authenticity, integrity, and confidentiality of data, detect and handle ICT incidents, identify key ICT third-party dependencies, ensure continuity of critical or important functions, regularly test continuity measures and controls, and feed test and incident lessons back into ICT risk assessment.

A defensible proportionality decision connects the scaled measure to the risk facts DORA names. The evidence should show why the selected control, test, policy, supplier-monitoring depth, or remediation timetable is adequate for the entity's size, risk profile, services, activities, operations, and ICT dependencies.

Delegated Regulation (EU) 2024/1774 gives useful evidence categories: the context of the entity's services and operations, identified critical functions, major projects or activities, relationships, dependence on in-house and outsourced ICT services and systems, the effect of severe degradation or loss, current and near-term ICT risk, threat landscape, control effectiveness, and security posture.

Proportionality does not erase DORA's core control points. It cannot be used to avoid having an ICT risk management framework, to ignore major ICT-related incidents, to skip required reporting, to transfer responsibility to a supplier, or to decline TLPT after the relevant authority identifies the entity as required to perform it.

It also cannot replace supervisory judgment. DORA says competent authorities consider how financial entities apply proportionality when reviewing ICT risk management framework reports submitted under Articles 6(5) and 16(2). For TLPT, competent authorities identify the financial entities required to perform advanced testing based on impact-related factors, financial stability concerns, and ICT risk profile, maturity, or technology features.