TIBER-EU support: what can an entity hand to outside help?
If a regulator, a contract or a DORA requirement now calls for a TIBER-EU test, the first point to settle is that the threat intelligence provider must always be external, and external red team testers are strongly encouraged. The entity keeps ownership of the test throughout. Outside help can cover the providers, an external control team lead where beneficial or necessary, and project and evidence work such as documenting the compliance assessment. The board, the entity's own control team and the TIBER Cyber Team keep the decisions: the board delegates management of the test to the control team lead, and the test manager reviews the provider choice without giving commercial advice.
How much can be handed out depends on the entity. A significant credit institution may use only external red team testers, because Article 26(8) of DORA requires entities that use internal testers to contract external testers every three tests and limits significant institutions to external testers. An entity that wants internal testers needs the test manager's prior approval, and testers employed by an ICT intra-group provider count as internal. Entities with group companies or intra-group ICT providers should confirm early whether those staff can sit on the control team or the blue team, since the conflict and separation rules apply to them as well.
Before signing anything, the entity should map each role against its own structure: who will lead the control team, which provider staff must be kept apart, and which internal people must stay outside the test. Ask the authority which optional requirements it has adapted locally, because national rules can narrow what outside help is acceptable. Confirm the independence declarations, NDAs and vetting arrangements in writing, so that the control team can show the test manager a clean record of who did what.
Which tasks outside help can take and which stay with the entity
The tested entity owns the test from start to finish. Outside help can carry much of the work, but accountability for decisions, budget and the remediation that follows stays with the entity and its board. The board should delegate management of the test to the control team lead, who needs authority to take full control of the testing process and direct access to senior management. Under the framework, costs and risks are borne by the tested entity in every case.
- Ownership of decisions: The board approves the scope, the choice of providers and the closure outcome, and it cannot hand these decisions to a vendor.
- Budget and procurement: The entity signs the contracts with the threat intelligence provider and the red team testers, and it funds both external firms and internal hours.
- Remediation: Fixing the weaknesses, owning the remediation plan and tracking it to completion remain internal responsibilities.
- Named backup: The entity must designate a backup for the control team lead, which outside advisers cannot fill on its behalf.
- Internal staffing: Blue team members, system owners and business process experts must come from inside the organization or its group.
Before engaging any outside firm, confirm in writing which decisions the board has reserved for itself and which it has delegated to the control team lead.
The control team runs the test day to day on the entity's behalf. Under the Control Team Guidance, an external control team lead is allowed where beneficial or necessary, subject to vetting, an NDA, no retention of sensitive data, due diligence on the person and firm, and a contract. The external lead cannot be employed by the test's threat intelligence provider or red team testers at the same time. Other members may come from the entity, other group entities or third-party providers.
- Lead role: An external consultant can serve as control team lead, but the lead must not also be working for the testing firms.
- Members from providers: Third-party staff can join as members, provided they meet the same vetting and conflict rules.
- Compliance assessment: The control team documents its own assessment of whether each provider is compliant and passes the evidence to the test manager. An outside firm can help draft this file but cannot replace the control team's judgment.
- Confidentiality: Awareness of the test stays limited to the control team on a need-to-know basis, and the control team can halt the test at any time.
- Time commitment: The Control Team Guidance indicates the lead spends about 4 to 8 hours a week in the 24-week preparation phase and 10 to 30 hours a week during red teaming, with other members spending roughly half that.
Confirm the lead's named back-up, the signed NDA and the conflict declarations before the first control team meeting.
The threat intelligence provider must always be external to the entity. It produces the targeted threat intelligence report, which identifies the threat actors, scenarios and attack paths that the red team will follow. This is the job most entities cannot do in-house, and it is the first place where the independence rules limit who can be hired.
- Outsourced in practice: Gathering and analyzing threat intelligence, building the targeted threat intelligence report and proposing scenarios for the control team to approve.
- Must stay separate: Threat intelligence staff must not take part in blue team work, and they must be separated from the red team staff of the same provider for the same test.
- Conflict limits: The provider must have no previous or current services for the entity that create a conflict of interest.
- Entity responsibility: The control team must review and approve the scenarios and the flags, and it keeps the decision on what the red team may target.
- Deliverables: The provider's outputs follow the ECB guidance documents, and the entity should confirm the format and timing with the test manager early.
Ask each candidate provider to show how it separates its teams and how it will document any prior work for your organization.
Red team testing is the part of the test most often outsourced in full, and external testers are strongly encouraged. Internal testers may be used only in exceptional circumstances, with the test manager's prior approval, and must meet the same standards. Testers employed by an ICT intra-group provider count as internal. Article 26(8) of DORA requires entities that use internal testers to contract external testers every three tests, and credit institutions classified as significant may use only external testers.
- Outsourced in practice: Writing the red team test plan, executing attacks against the flags, and writing the red team test report.
- Must stay separate: Red team staff must be separated from the threat intelligence staff of the same provider for the same test.
- Internal testers: Using them requires the test manager's prior approval and an explanation of the exceptional circumstances.
- Control and stop rights: The control team supervises the testing and can halt it, so the entity must keep the ability to act on that right.
- Contract terms: Rules of engagement, data handling and incident escalation must be written into the contract with the provider.
Check whether your intra-group or existing service providers would count as internal before you decide who tests.
The TIBER Cyber Team at the authority supervises the test, and each test has a dedicated test manager with at least one alternate. The test manager reviews the entity's compliance documentation and approves key steps. The test manager does not give commercial advice on provider selection. The framework also strongly encourages that TIBER Cyber Team members are not involved in the test in a supervisory or oversight capacity, which is a role split from the advisory support the entity may seek.
- Reviews, not selection: The test manager reviews the control team's evidence and assesses each provider as compliant or non-compliant, but does not recommend which firm to hire.
- Hard stop on contracts: The control team must not contract any provider that the test manager assesses as non-compliant.
- Approvals: The test manager approves exceptions such as internal testers and key deliverables at each stage.
- Accompaniment: The authority accompanies the test. It does not run it, and the tested entity keeps ownership.
- Outside help: Consultants can prepare the entity's file for review, but they must not present themselves as the authority's agents or substitute for its decisions.
Ask your authority, in writing, which documents it expects in the compliance file and how it prefers to receive them.
How external threat intelligence and red team providers fit the test
A TIBER-EU test runs four parallel provider and team components, and each has a different rule on who may supply it. The threat intelligence provider must be external, red team testers are strongly encouraged to be external, internal testers are a narrow exception, and the entity's own blue team stays in-house.
External threat intelligence provider
This provider must always be external to the entity. It produces the targeted threat intelligence report and the scenarios the red team then tests against. Staff from this provider cannot do blue team work, and its threat intelligence and red team staff must be separated for the same test. Check for past or current services to the entity that could create a conflict of interest before contracting, and confirm the test manager's view on the shortlist.
External TIBER-EU red team providers
External red team testers are strongly encouraged, and they are the default choice for most entities. Their work is the active attack against the flags under control team supervision. Ask each provider to show how its testers meet the same standards the framework sets for internal staff, and confirm that the provider has no conflict of interest with the entity or the threat intelligence provider.
Internal testers as an exception
Internal testers may be used only in exceptional circumstances, and only with the test manager's prior approval. They must meet the same standards as external testers. Staff employed by an ICT intra-group provider count as internal, so a group service company's testers do not qualify as external. Document the reason for the exception before the procurement step begins.
Article 26(8) external testing rule
Under Article 26(8) of DORA, an entity that uses internal testers must contract external testers every three tests. Credit institutions classified as significant may use only external testers. Plan the test calendar with this rule in view, since an entity relying on internal staff for one cycle may face an external requirement at the next.
The blue team stays in-house
The entity's own blue team defends its systems during the test and cannot be outsourced to the test's threat intelligence or red team providers. A provider that defends the same systems it attacks would create a conflict of interest. Keep blue team staffing and the decisions it makes under entity control, and use outside help only for independent support where the framework allows it.
Can an external control team lead run a TIBER-EU test?
Yes, but only where it is beneficial or necessary, and the Control Team Guidance attaches conditions that the entity must meet before it appoints one. The external control team lead must be vetted, sign a non-disclosure agreement, retain no sensitive test data, and pass due diligence on both the individual and the firm that provides them. The engagement must be governed by a contract. The lead also cannot be employed by the test's threat intelligence provider or by its red team testers at the same time, so the entity should check the staffing of every provider before it accepts a candidate. Conflicts can arise through a shared employer, a subcontract or a recent role, and the entity should ask for a written statement on each of these points.
The board delegates management of the test to the control team lead, and that delegation only works if the person has real authority. The guidance expects the lead to be able to take full control of the testing process, to reach senior management directly, and to have a designated back-up who can step in. It also expects experience in red team testing, crisis management and procurement. Before appointing an external lead, the entity should confirm in writing who holds the decision rights during a live red team exercise, how a halt decision is made and who the back-up is. These are decisions the organization owns, even when the person running the day-to-day control team is not an employee.
The Control Team Guidance gives indicative effort for the lead: about 4 to 8 hours a week during the 24-week preparation phase, 8 to 16 hours a week during threat intelligence (4 to 6 weeks), 10 to 30 hours a week during red teaming (14 to 15 weeks) and 8 to 12 hours a week during the 18-week closure phase. Other control team members are expected to spend roughly half of these hours. Treat these figures as a starting point only. The entity must confirm the hours in its own plan, because an external lead's fees will track the hours agreed in the contract, and the peak red teaming window is where underestimating effort creates the most risk.
How project and evidence support fits the three phases
This sequence shows where outside help can carry project management, document preparation and evidence packs across the preparation, testing and closure phases, and which decisions the entity must make and sign itself. Read it alongside the ECB's 2025 guidance documents, which set the expectations the control team works to.
Set up the evidence register at notification
When the authority's written notification arrives, the control team lead opens a register that maps each TIBER-EU deliverable and approval to an owner, a due point and a storage location. An external project support team can build the register, maintain the document index and chase open items, but the entity's control team lead owns it and decides what goes into the file. The step is done when every mandatory deliverable has a named owner and the register has been shared with the test manager.
Prepare initiation and scoping documents
During initiation and scoping, the entity identifies critical or important functions and flags, and records them in the initiation document and the scope specification document. External support can draft these documents from the entity's own inputs, reconcile versions and check them against the ECB guidance for each document. The board-level decisions on scope, flags and risk management stay with the entity, and the control team lead signs off before the documents go to the test manager. Completion is a signed scope specification that the test manager has reviewed.
Support procurement without making the choice
The entity must procure the threat intelligence provider and red team testers under the ECB's service provider procurement guidance. External support can prepare the tender pack, track responses, compile the compliance assessment evidence and document how each provider meets the conflict and independence rules. The entity decides which provider to contract, and the test manager reviews the control team's assessment without giving commercial advice. Completion is a documented compliance assessment for each provider that the test manager has seen before any contract is signed.
Track threat intelligence and the red team test plan
In the testing phase, the threat intelligence provider produces the targeted threat intelligence report and the red team testers draft the red team test plan. External support can run the review cycle, log comments and maintain the change record that shows how each comment was resolved. The control team approves the scenarios and the plan, and the test manager must agree before active testing starts. Completion is an approved plan and a complete review log that the entity can produce on request.
Keep the control log during active red team testing
Active red team testing runs for at least 12 weeks against the flags, under control team and test manager supervision. External support can keep the control log, record every escalation, time-stamp decisions to halt or continue, and maintain the code-name and need-to-know records. The control team lead makes every halt or continue decision and stays the single point of contact with senior management. Completion is a closed control log that accounts for each event during the test.
Assemble the closure evidence packs
Within the closure phase, the red team and blue team test reports, the replay and the purple teaming sessions must be finished within 10 weeks of the end of active testing. External support can assemble evidence packs that link each finding to logs, detection records and the replay results, and can prepare the 360 degree feedback forms. The entity's blue team and control team validate the findings and decide what the purple teaming sessions cover. Completion is a reviewed evidence pack per finding that the test manager can trace back to source records.
Draft the test summary and remediation plan
The test summary report and the remediation plan are due within 8 weeks of the authority's assessment. External support can draft both documents, track each remediation item to an owner and date, and map them to the ECB guidance documents. The entity owns the remediation commitments, the accepted risks and the budget, and the board or senior management approves the final plan. Completion is an approved remediation plan with a named owner for each action.
Sign the attestation and archive the file
The attestation is the final closure deliverable and must be signed by the entity's accountable representatives. External support can check that every deliverable, approval and evidence pack is complete and cross-referenced before signature, and then archive the file under the entity's retention rules. The signature remains an entity decision, and no external party issues or signs the attestation on the entity's behalf. Completion is a signed attestation and an archived file that the entity can produce for the authority and its own auditors.
Where outsourcing goes wrong in a TIBER-EU test
Most TIBER-EU support work can be handed to outside firms, but a few roles and decisions stay with the entity. The cards below cover the places where entities most often cross that line, and what to check before work starts.
Control team lead tied to providers
An external control team lead can be a useful choice, but the same firm cannot also work for the threat intelligence provider or the red team testers on the same test. Entities sometimes hire a consultancy for the lead role without checking whether that firm already staffs the providers they have selected. Before signing, ask the lead's firm to list every current or recent engagement with the chosen providers, and confirm the lead is vetted, under NDA, and contracted directly with the entity.
Providers running the blue team
Threat intelligence staff must not do blue team work, and the threat intelligence and red team staff of one provider must be separated for the same test. Problems arise when a provider offers to run detection, monitoring or incident response for the tested entity during the test. The entity should keep its blue team in-house or with a separate firm that has no role in the threat intelligence or red team work, and should record that separation in the procurement file.
Board without a named delegate
The board should delegate management of the test to the control team lead, who needs authority to take full control of the testing process and direct access to senior management. Without a named person in that role, decisions about halting the test or handling a live incident stall. Name the lead and a designated back-up in a board minute, and confirm the delegation covers emergency stops and access to senior management.
Internal testers without prior approval
Internal red team testers may be used only in exceptional circumstances, and only with the test manager's prior approval. Testers employed by an ICT intra-group provider count as internal. Entities sometimes staff a test with existing security engineers or group staff to save procurement effort, then discover the approval was never sought. Request the test manager's written approval before any internal tester is named, and check the Article 26(8) rule requiring external testers every three tests.
Assuming the test manager picks providers
The test manager assesses provider compliance but does not give commercial advice on provider selection. The control team documents its own compliance assessment and passes the evidence to the test manager, and must not contract any provider the test manager assesses as non-compliant. Entities that expect the authority to recommend a firm will find the choice is theirs. Build a shortlist, run due diligence on conflicts and references, and submit the evidence file early so the test manager can respond before contracts are signed.
TIBER-EU support questions buyers ask before hiring outside help
Can we run a TIBER-EU test with only internal staff?
Not entirely. The threat intelligence provider must always be external, so the entity cannot produce the targeted threat intelligence in-house. Red team testing can be internal only in exceptional circumstances, and only with the test manager's prior approval. Internal testers must meet the same standards as external ones, and testers employed by an ICT intra-group provider count as internal. The control team and blue team can be staffed from within the entity, though the entity must still confirm with its authority how it applies these rules.
Can we hire an external control team lead?
Yes, where it is beneficial or necessary, under the ECB's Control Team Guidance. The external lead must be vetted, sign a non-disclosure agreement, avoid retaining sensitive data, and pass due diligence on both the person and the firm. A contract is also required. The external lead cannot be employed by the test's threat intelligence provider or red team testers at the same time. The board still delegates management of the test to the control team lead, who needs authority to take full control of the process, direct access to senior management and a designated back-up.
Can a consultant act as the TIBER-EU test manager?
No. Each test has a dedicated test manager and at least one alternate, both drawn from the TIBER Cyber Team at the authority, who have sector, cyber and project management experience. A consultant cannot take this role. The test manager reviews the control team's compliance assessments and evidence, and does not give commercial advice on provider selection. Outside help can support the control team, but the entity should confirm the test manager arrangements directly with its authority.
How many hours a week does the control team need per phase?
The ECB's Control Team Guidance gives indicative effort for the control team lead. The lead spends about 4 to 8 hours a week during the 24-week preparation phase, 8 to 16 hours a week during threat intelligence (4 to 6 weeks), 10 to 30 hours a week during red teaming (14 to 15 weeks), and 8 to 12 hours a week during the 18-week closure phase. Each other control team member spends roughly half those hours. These figures are guidance, so the entity should plan its own staffing against the timeline agreed with its authority.
Must we contract external red team testers?
It depends on the entity. Credit institutions classified as significant may use only external red team testers. For other entities, external testers are strongly encouraged, and Article 26(8) of DORA requires entities that use internal testers to contract external testers every three tests. Internal testers are permitted only in exceptional circumstances with the test manager's prior approval. The entity should confirm its classification and test history with its authority before planning the red team sourcing.
Who pays for outside help during a TIBER-EU test?
The tested entity pays. The Banco de Espana's TIBER-ES guide states that the requirement to use external providers makes TIBER tests expensive, and that the costs and risks are borne in all cases by the tested entity and never by the authorities adopting the framework. Outside spending typically covers threat intelligence, red team testing, and any external control team lead or project support. Ask each provider for a written quote tied to a defined scope, and confirm with the authority whether it charges any fees of its own.
What should we keep in-house even with outside help?
The entity keeps ownership of the test and of its controls. Under the TIBER-FR guide, the tested entity owns the test while the authority's TIBER Cyber Team accompanies it throughout. The entity must supply the human and financial resources, and it decides on the control team, the blue team and remediation. Threat intelligence staff cannot do blue team work, and providers must have no conflicting services for the entity. Keep decision rights, confidentiality arrangements and the remediation plan under the entity's own leadership.
What to confirm with your authority before you hire
Before you contract any outside party for a TIBER-EU test, confirm the rules that apply in your jurisdiction, because the authority and its national implementation document decide what you may outsource. Start with the national implementation document for your country, which sets the local rules on top of the framework's mandatory requirements. Then ask the TIBER Cyber Team whether it accepts an external control team lead, what vetting and contract terms it expects from that person and their firm, and whether it wants to see your procurement approach before you sign anything. Your authority's answers determine whether a lead from an outside firm is possible at all, and they should be recorded in writing before the control team is staffed.
Next, confirm the procurement expectations for threat intelligence and red team providers. The ECB's service provider procurement guidance and the test manager's review of your compliance assessment set the bar for selection, and the control team must not contract any provider the test manager assesses as non-compliant. Ask the test manager which documents they expect to see, how they want the conflict of interest declarations presented, and whether their approval is needed before a provider's scope or staffing changes. If you plan to use internal testers, which the framework allows only in exceptional circumstances, get the test manager's prior approval in writing and confirm the external testing obligations that apply to your entity under DORA Article 26(8).
Finally, be clear about what no provider can give you. DeployOpen prepares systems, controls and evidence and can support your team through the test, but it does not issue test reports, attestations or certificates. The red team and blue team reports, the test summary report and the attestation come from the independent providers and the authority's process, and your entity owns the remediation plan. Ask any firm you are considering to state in its written scope which deliverables it will produce and which it will only support, and confirm with your authority who will sign and receive each output.
How DeployOpen supports the entity's side of a TIBER-EU test
DeployOpen helps the tested entity prepare its own systems, controls and evidence for a TIBER-EU test. The entity keeps ownership of the control team, the decisions and the remediation, while threat intelligence and red team providers are procured separately and must meet the framework's independence rules. DeployOpen does not issue test reports or attestations.
How we scope
- We agree in writing which entity-side tasks sit with DeployOpen and which stay with the entity's control team.
- We map the roles that must be owned internally, such as the control team lead decisions and the blue team, against the outsourceable support.
- We confirm how the test manager, the threat intelligence provider and the red team testers are kept separate in the agreed scope.
How we build
- We set up the project and evidence tracking the control team uses to document its compliance assessment for the test manager.
- We prepare the systems in the entity's own infrastructure so the test team has a documented, controlled environment to work within.
- We help the entity assemble the procurement and contract records that show each provider was checked for conflicts of interest.
How we hand over
- We hand over the evidence pack, runbooks and document registers in a form the entity's own staff can maintain after the test.
- We walk the control team and blue team through the deliverables they must produce or review at each phase.
- We document which decisions, approvals and signatures remain with the entity, so ownership stays clear at closure.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, agreed separately from the fixed-scope engagement.
- We can support remediation tracking after the test summary report, using the entity's own remediation plan as the reference.
- We refer questions about the test's findings or attestation to the authority and the independent parties who issue those documents.
