TIBER-EU 2025 update: what changed in the framework

The procurement lead and the CISO should read the Guidance for Service Provider Procurement first, because it explains how to assess the quality of a threat intelligence or red team provider before a contract is signed. It informs which providers are shortlisted, what the contract must cover and which independence checks the test manager will later review. Read it alongside the TIBER-EU Framework (January 2025) so procurement and the test manager use the same definitions. The ECB states that the new guidance documents draw on practical experience from earlier TIBER tests, so the questions it poses reflect what worked and what did not in those tests. Keep the provider's written answers in the procurement file as evidence.

The control team lead and the entity's risk owner should read the initiation documents guidance first, then the scope specification guidance. The initiation guidance informs the formal start with the authority, the people named to the control team and the risk management arrangements. The scope specification guidance informs which critical or important functions and flags enter the test. Scope decisions made here set the work for every later phase, so changes after approval are costly in time and effort. Ask the authority's test manager which format and level of detail they expect before drafting, because the guidance describes the content but local practice may add expectations.

The threat intelligence provider reads the targeted threat intelligence report guidance first, and the red team lead reads the red team test plan guidance next. The threat intelligence guidance informs scenario selection, which determines the attack paths the red team will test against the flags. The red team test plan guidance informs how the red team sets out its approach before active testing begins, and the control team and test manager supervise that plan. Active red team testing must run for at least 12 weeks under this supervision. Confirm with the authority which version of each document applies to a test that started before the January 2025 update.

The control team lead and the blue team lead should read the control team guidance and the purple teaming guidance. The control team guidance informs how the control team is staffed, its role in supervising the test and how it handles the entity's own staff during the test. The purple teaming guidance informs how red and blue teams work together to review attack activity and improve detection. Purple teaming is mandatory under the 2025 update. Delegated Regulation (EU) 2025/1190 Article 12(5) requires the replay and purple teaming no later than 10 weeks after active testing ends, so plan the sessions and their staffing backward from that date.

The red team lead and the blue team lead should read the red team and blue team test report guidance before drafting their reports. The red team guidance informs how attack activity, flags reached and evidence are recorded. The blue team guidance informs how the entity documents what it detected, how it responded and where monitoring or response fell short. Both reports feed the remediation plan and the test summary report, so agree on a common finding structure early. Consistent identifiers for each finding make it easier for the control team to trace a gap from the report to its remediation item. Confirm with the test manager whether the authority expects a specific template.

The remediation owner and the CISO should read the remediation plan guidance, and the board-facing risk function should read the test summary report guidance. The remediation guidance informs how each weakness is assigned an owner, a fix and a date. The test summary report guidance informs what leadership needs to see to judge the test's outcome. Under the framework, the remediation plan is due within 8 weeks of the authority's assessment, so budget and staffing for fixes should be agreed before that assessment arrives. TIBER-EU tests do not produce a pass or fail result, so frame the summary around strengths and weaknesses.

The compliance lead and the test manager should read the attestation guidance last, once the test summary report and remediation plan are drafted. The attestation guidance informs what the closing statement must confirm and which earlier deliverables it relies on. Read it before the closure phase starts, because it shows which records need to exist for the attestation to be supported. Confirm with the authority who signs the attestation and what evidence they expect alongside it. An implementation partner can help assemble the records, but the attestation itself and the authority's assessment come from the entity and the authority, not from the partner.

Confirm this with your authority's TIBER Cyber Team before changing anything, because the answer depends on the transition arrangements in your national document and on which phase the test has reached. The January 2025 framework aligned the process steps with the deliverables and timelines of the DORA TLPT standards, so a test that has not yet reached its later deliverables will likely be expected to meet the updated requirements. Ask your test manager which guidance documents apply to each remaining deliverable, and record that answer in the test file. Keep a short log of the version agreed for each step so the closure phase does not rely on memory.

Yes, purple teaming adds work, but the main effort is timing rather than a separate testing exercise. The 2025 update made purple teaming mandatory, and Delegated Regulation (EU) 2025/1190 Article 12(5) requires the replay and purple teaming no later than 10 weeks after active testing ends. The cost drivers are the number of attack paths that need replaying, the number of blue team staff who take part, the availability of the red team testers at short notice, and how many detection gaps need fixing before the session. Ask providers to price the replay and purple teaming sessions as a separate line in the written scope, so you can see the effort rather than assume it is included.

The time depends on how many people sit on the Control Team, how many flags and scenarios the test covers, and how often the team must approve or review red team activity during active testing. The Control Team sits between the tested entity and the red team, so its members must be available for supervision decisions throughout the testing phase, not only at milestones. The 2025 update renamed the White Team to the Control Team, and the ECB published a dedicated guidance document for it. Ask your test manager and your provider to agree a written estimate of Control Team hours per phase, and check whether any member also serves on the blue team, which the guidance may restrict.

Your team can prepare many of the deliverables, but the independence and conflict rules decide which ones it can author and which must come from the providers or the authority. The ECB publishes a guidance document for each main deliverable, including initiation documents, the scope specification document, the red team test plan, the blue team test report, the remediation plan and the attestation. Internal staff are well placed to prepare the scope specification, the remediation plan and evidence of existing controls, while the threat intelligence and red team outputs must come from the independent providers. Confirm the authorship rules for each deliverable with your test manager before work starts, so your team does not prepare outputs that must come from someone else.

Shorter national documents mean the framework itself carries more of the rules, so your plan should start from the European text and then check only the local additions. The 2025 update allowed authorities to publish a short implementation document instead of a full national guide. The Bundesbank's TIBER-DE implementation document, version 4.0 from July 2025, says it is no longer necessary to adapt test components nationally because the TIBER-EU content applies directly and fully. Build your timeline from the phase deadlines in the framework, then list the national points your authority has added, such as contacts, fees or reporting channels. Check these points with your authority early, since they are the items most likely to differ between countries.

The core requirements are the same, but meeting them is not automatically the same as meeting DORA TLPT in your jurisdiction. The ECB states that the core requirements of DORA TLPT and TIBER-EU are identical, so a test completed under a national or European TIBER-EU implementation is DORA TLPT-compliant if it also meets the formal requirements set by your competent authority. Those formal requirements can include who the authority is, how results are reported and which tester rules apply. The 2025 update aligned timelines with the DORA TLPT standards, and Sweden has stated that TIBER-SE will be used for DORA TLPT. Ask your competent authority to confirm in writing which formal requirements sit on top of the TIBER-EU test.

The authority's test manager, working with the TIBER Cyber Team, issues the formal outputs of a TIBER-EU test, including the attestation that closes the test. The entity owns its controls and its remediation plan, and the threat intelligence provider and red team testers produce their own reports, which the authority then reviews. DeployOpen prepares systems, controls and evidence for an assessment, but it does not issue attestations, reports or certificates. Ask your authority which outputs it will issue, which ones the entity submits, and which ones the providers deliver, and write that split into the engagement documents so that no party assumes another will produce a required item.