How TIBER-BE works for a Belgian institution under the National Bank's supervision
The National Bank of Belgium adopted TIBER-EU in May 2018, and its TIBER-BE team is the central contact for TIBER-BE and DORA TLPT tests at institutions it supervises. Voluntary TIBER-BE exercises follow a three-year cycle and are aimed at critical market infrastructures and core financial institutions under the Bank's supervision or oversight. If your institution is a supervised Belgian entity or market infrastructure, the first question to answer is whether your test is voluntary or mandated under DORA, because that answer sets who initiates the test, how the Bank's role is framed, and how much of the work is driven by your supervisory file rather than by your own planning cycle. The second question is your scope and maturity, which determine which functions are tested and how much preparation your teams need before the test starts.
Whichever route applies, the division of roles stays the same. Your organization owns its controls, and your control team and blue team handle the defensive side of the exercise. A specialised threat intelligence provider prepares the targeted threat intelligence, and a red team provider carries out the attacks on live production systems. The NBB coordinates the test through the TIBER-BE team. Confirm early with the Bank which of these roles you must procure yourself and which the Bank expects you to fill, since the framework requires providers to be procured separately from the supervisory relationship. Ask the TIBER-BE team to confirm in writing whether your test is treated as a TIBER-BE exercise, a DORA TLPT, or both, because the answer governs the documents you must produce and the reports the Bank expects.
Start by writing down your position against the test cycle. If you have a recent test, the three-year interval is the norm, so a second test in that window needs a clear reason and agreement with the Bank. If you are not yet sure whether DORA requires you to test, raise that with the TIBER-BE team before you commit budget to providers. Gather the material the Bank will ask about first: the list of critical or important functions you propose to include, the ICT systems that support them, and the owners who will sit on the control team. Then read the TIBER-BE National Implementation Guide (2025) against your internal plan, and confirm each point of difference with the Bank rather than assuming it is acceptable. Mismatches found at this stage are far cheaper to resolve than mismatches discovered during the testing phase.
Voluntary TIBER-BE tests versus mandatory DORA TLPT
The NBB runs TIBER-BE exercises on a voluntary basis for critical market infrastructures and core financial institutions under its supervision or oversight. The bank's TIBER-BE team conducts and coordinates these tests, and the entity takes part as a partner in improving its own defenses rather than as a subject of a compliance finding. The framework treats intervals of three years between tests as the norm, because of the resources and costs involved, so an entity should expect one exercise per cycle rather than a rolling programme.
- Who triggers it: The NBB selects or accepts participants among its supervised and overseen institutions, and the TIBER-BE team is the first contact.
- What the entity must do: Commit senior management and a control team to the scope, provide access to people and systems, and agree on the procurement of external threat intelligence and red team providers.
- What the NBB owns: The authority leads the test process, coordinates the TIBER Cyber Team, and keeps the framework's quality standards.
- What the entity owns: Its production systems, its remediation plan, and the decisions about what to change based on the findings.
- Outcome: The test produces no pass or fail result. It shows strengths and weaknesses so the entity can raise its cyber maturity.
Confirm with the TIBER-BE team whether your institution is in the current voluntary cycle and what the expected timing and resourcing are.
DORA threat-led penetration testing is a regulatory obligation under the EU Digital Operational Resilience Act, and it sits within prudential supervision. Whether an entity must test is decided by the supervisor, not by the entity's own choice. The NBB states that DORA TLPT and TIBER-EU tests are essentially compatible, and that TIBER-EU materials give additional guidance on the DORA TLPT requirements, so the same method applies in both routes.
- Who triggers it: The supervisor identifies the entities that must carry out TLPT, and the obligation follows that decision.
- What the entity must do: Run a test that meets the DORA TLPT requirements, including the procurement of qualified external testers and the required reporting.
- What the NBB owns: Its prudential supervisory role, the identification of obligated entities, and the TIBER-BE team's coordination of DORA TLPT tests at NBB-supervised institutions.
- What the entity owns: Compliance with the obligation, the costs of the test, and the regulatory response to findings within supervisory deadlines.
- Scope: Mandatory tests are not optional and cannot be replaced by a voluntary exercise, so an entity should check with its supervisor which obligation applies.
Ask the NBB in writing whether a DORA TLPT obligation applies to your institution, and which deadlines and documents the supervisor expects.
Entities often ask whether a voluntary TIBER-BE exercise can satisfy a DORA TLPT obligation. The answer depends on how the supervisor has framed the requirement, and the entity should not assume equivalence without written confirmation. Because the two routes share a method, preparation work done for one can usually inform the other, but the governance, status and consequences differ.
- Confirm the trigger: Ask whether the institution has been identified for mandatory TLPT or is invited to a voluntary exercise.
- Confirm the status: Ask whether a voluntary test would count toward a DORA obligation, and in what form.
- Align the documents: Map the TIBER-EU deliverables to the DORA TLPT deliverables your supervisor expects, and agree the differences in writing.
- Plan the cycle: Use the three-year norm to plan budgets and internal capacity, and check whether a mandatory test changes that timing.
- Assign ownership: Name one accountable executive for the test and one contact for the NBB.
Record the answers from the NBB in writing before committing budget or selecting providers.
How a TIBER-BE test moves from notification to attestation
The sequence runs through three TIBER-EU phases, with the TIBER-BE team coordinating each step and external providers carrying out the attacks on live production systems. Each phase ends with a named output that the next phase depends on.
Receive written notification and start initiation
The preparation phase begins when the National Bank of Belgium notifies the entity in writing that it is to take part in a TIBER-BE test. The TIBER-BE team then leads initiation, where the entity confirms its test purpose, its appetite for risk and the parties it will involve. The preparation phase lasts up to six months from that written notification. The step is complete when the initiation documents are agreed and the test has a named owner on both sides.
Set up the control team and risk management
The entity appoints a control team, which is the group that knows about the test and supervises it on the entity's side while keeping the blue team unaware of the red team's activity. The control team agrees how the test will be managed to avoid harm to live services and how incidents during testing will be handled. The output is a documented risk management approach that the TIBER-BE team reviews before scoping starts.
Scope critical functions and flags
The entity identifies its critical or important functions and the systems that support them. The TIBER-BE team and the entity agree the scope specification, which sets out the flags, the target systems and the boundaries the red team must respect. The output is a scope specification document that the national authority accepts as the basis for procurement and threat intelligence.
Procure threat intelligence and red team providers
The entity procures a threat intelligence provider and red team testers that meet the TIBER-EU requirements for service providers. Specialised external providers, not the entity's own staff or the authority, prepare and carry out the attacks. The TIBER-BE team coordinates the procurement and confirms that the providers' contracts reflect the framework. The preparation phase closes when the providers are contracted and ready to begin.
Produce targeted threat intelligence and the red team test plan
The threat intelligence provider prepares a targeted threat intelligence report that identifies the threat actors and scenarios most relevant to the entity. The red team then drafts a red team test plan that turns those scenarios into actions against the agreed flags. The TIBER-BE team reviews both documents with the control team before any live testing starts. The testing phase begins once the plan is approved.
Run at least 12 weeks of active red team testing
The red team carries out attacks on live production systems over at least 12 weeks, under the supervision of the control team and the TIBER-BE team. The blue team does not know the test is under way, so its detection and response are measured as they would be against a real attacker. The step ends when active testing stops and the red team's activity is recorded for reporting.
Deliver red and blue team reports, replay and purple teaming
The red team and blue team each write a test report, and the entity and providers hold a replay session that walks through the attack path against the defensive timeline. Purple teaming follows within 10 weeks of the end of active testing, with the red and blue teams working together on the gaps found. The output is a set of agreed findings that feed the closure documents.
Issue the test summary, remediation plan and attestation
The 360 degree feedback gathers views from the parties involved, and the entity drafts a test summary report and a remediation plan. The remediation plan is due within 8 weeks of the authority's assessment. The entity then receives the attestation confirming the test was completed under the framework, which closes the test. The TIBER-BE team confirms completion and keeps the record for the authority's supervision.
How TIBER-BE testing counts toward DORA TLPT
A voluntary TIBER-BE exercise is not automatically a mandated DORA threat-led penetration test. The ECB states that the core requirements of DORA TLPT and TIBER-EU are identical, and the National Bank of Belgium (NBB) describes the two as essentially compatible, with TIBER-EU materials giving additional guidance on DORA TLPT requirements. Compatibility of method, however, does not decide whether a given test satisfies a given obligation. Under the NBB's approach, TIBER-BE exercises are voluntary and run on a three-year cycle for critical market infrastructures and core financial institutions under its supervision or oversight, while DORA TLPT is mandatory and part of prudential supervision. An institution should therefore not assume that a TIBER-BE test it has completed, or is planning, will be accepted as its DORA TLPT.
Before committing to a test, ask the TIBER-BE team, the NBB's central contact for TIBER-BE and DORA TLPT tests at supervised institutions, which tests the NBB will treat as meeting a DORA requirement, and under what conditions. Confirm which DORA obligations apply to your entity, whether the test would be counted in full or in part, and whether any results or reports must be shaped to serve supervisory purposes. Ask how the NBB's supervisory team will be informed and involved, and who signs off on that position. Any answer that changes what the test covers, who runs it, or how the outputs are used should be recorded before work starts.
Agree these points in writing before the test starts, not after the red team has finished. The written agreement should state the legal basis for treating the exercise as voluntary or mandated, the scope and flags, the threat intelligence and red team providers the entity procured, the reports and attestation the NBB expects, and the timing of any supervisory handover. Where the entity needs a single test to serve both a voluntary TIBER-BE purpose and a DORA TLPT obligation, the agreement should name which requirements are covered and which must be met separately. An implementation partner can prepare systems, evidence and documentation for the test, but the decision on what counts toward DORA rests with the NBB and the entity's own compliance function.
What a Belgian institution should have in place before the notification
A TIBER-BE test starts with a written notification and a preparation phase of up to six months, so most of the work happens before the National Bank of Belgium's TIBER-BE team hears from you. The cards below cover the decisions, documents and people that should exist first, with a practical way to check each one.
Named accountable owner
Name one executive who answers to the board for the test, signs the scope and holds the remediation decisions afterward. The framework expects the tested entity to run its own control team and blue team, so this owner must have authority over both. To check it, confirm the name appears in the governance minutes and that the person can approve spend and access to production systems without escalation delays.
Agreed scope of critical functions
Scope covers the critical or important functions and the flags that the red team will try to reach, such as payment, settlement or customer data systems. Agree the list with business owners before the scope specification is written, because later changes delay the test. To check it, ask whether each function has a named business owner, a documented dependency map and a stated reason for inclusion.
Mature ICT risk and incident processes
A tested entity needs working ICT risk management and incident handling, since the control team and blue team are measured against the processes they already run. Immature processes produce findings that reflect process gaps rather than the test itself. To check it, review your last incident exercise, your current risk register and whether incident escalation has been tested end to end in the past year.
Compliant provider procurement route
Threat intelligence and red team providers must be procured under a route that meets the framework's requirements, and the 2025 guidance on service provider procurement sets out what that involves. Start the sourcing decision early, since the preparation phase covers procurement. To check it, confirm that your procurement policy, contract templates and conflict-of-interest checks have been reviewed against the current guidance.
Control team staffing plan
The control team manages the test on the entity's side, keeps knowledge of the exercise confidential and coordinates with the test manager. Staff it with people who can make operational decisions without exposing the test to the wider organization. To check it, confirm named members, their deputies, their reporting lines and how they will handle a live red team action that triggers a real alert.
Remediation budget and owners
The test produces a remediation plan that must be delivered on a fixed timeline after the authority's assessment, so funding and owners should exist before the findings arrive. Budget covers internal staff time, fixes to systems and any follow-up testing. To check it, ask whether funds for likely remediation are approved, whether each remediation owner has agreed to the work and whether the plan can be reviewed by the board.
Questions Belgian firms ask about TIBER-BE and DORA TLPT
Does a voluntary TIBER-BE test satisfy DORA threat-led penetration testing?
It can, but only when the test is run and governed as a DORA TLPT, which is a question for the National Bank of Belgium to confirm for your entity. The NBB describes TLPT and TIBER-EU tests as essentially compatible, and TIBER-EU materials add guidance on the DORA TLPT requirements. The NBB also states that TIBER-BE exercises are voluntary, while DORA TLPT is mandatory and part of prudential supervision. A voluntary exercise therefore does not automatically discharge a mandatory obligation. Ask the NBB early whether your planned test will be recognized as TLPT, and what it must contain to be. The NBB TIBER-BE framework page is the starting point for that conversation.
Who should a Belgian firm contact first about a TIBER-BE test?
Contact the TIBER-BE team at the National Bank of Belgium first. The NBB states that the team heads up TIBER-EU in Belgium, conducts and coordinates tests with supervised institutions, and is the central contact for both TIBER-BE and DORA TLPT tests at NBB-supervised institutions. Your supervisory team at the NBB should be informed in parallel where your entity's obligations are involved. Keep one written record of every exchange, since the test's scope and timing will be agreed through that channel. An implementation partner can help you prepare for that first conversation, but it cannot speak for the NBB or decide how the test is classified.
How often do TIBER-BE tests run for each entity?
The NBB says TIBER-BE exercises are performed on a voluntary basis on a three-year cycle for critical market infrastructures and core financial institutions under its supervision or oversight. The TIBER-EU framework also treats intervals of three years between tests as the norm, because of the resources and costs involved. Frequency is therefore a planning decision that the entity should make with the NBB rather than an open-ended choice. Confirm with the TIBER-BE team whether your institution falls within the target population and when your next cycle begins, especially if a mandatory DORA TLPT may also apply to you.
What must a Belgian entity provide before and during a test?
The entity provides the people, access and decisions that the test depends on. In practice this includes a named senior sponsor, a control team that can run the test without exposing it to staff outside the circle, and the information the threat intelligence provider needs to build a targeted scenario. Expect to supply scope material covering the critical or important functions and the flags the red team will pursue, along with agreed risk management arrangements. The entity must also keep the blue team's detection and response work realistic and record it for the closure reports. Confirm the exact document list with the TIBER-BE team, since the TIBER-EU guidance on initiation and scope specification sets out what each stage requires.
Who pays for threat intelligence and red team providers, and why does cost vary?
The tested entity normally procures and pays for the threat intelligence provider and the red team testers, because the framework requires that both be external. Cost is driven by the scope of critical functions and flags, the number of systems and locations in play, the length of active red team testing, the depth of threat intelligence needed, and the work required for replay, purple teaming and reporting. Recurring cost is limited because the test cycle is typically three years, but the preparation and closure phases still need staffing each time. Ask every provider for a fixed-scope quote that lists deliverables, assumptions about scope and exclusions. The NBB does not publish fees in the sources supplied here, so confirm any cost expectations with it directly.
Can a Belgian firm run a TIBER-BE test without external providers?
No. The framework requires external threat intelligence and red team providers, and the NBB states that specialized external providers prepare and carry out the attacks on live production systems. The entity still owns the process: its control team, blue team, risk management and remediation decisions remain internal. Internal staff can support the test, prepare systems and assemble evidence, but they cannot act as the red team for a TIBER-EU or DORA TLPT exercise. Choose providers that the NBB accepts for this purpose and check their qualifications against the requirements in the implementation documents before you sign.
Where does the 2025 TIBER-BE implementation guide fit in a test?
The TIBER-BE National Implementation Guide (2025) sets out how TIBER-EU is applied in Belgium, and it should be read alongside the TIBER-EU Framework dated January 2025. The framework update aligned TIBER-EU process steps with the DORA TLPT deliverables and timelines, so the guide is the Belgian reference for how those steps run locally. Use it to plan the preparation phase, which lasts up to six months from the authority's written notification, and the closure deliverables. Treat the guide as the governing text for Belgian specifics and the framework as the source for mandatory requirements. Start from the NBB TIBER-BE framework page to find the current guide.
Which sources to read first and what to confirm
Start with the National Bank of Belgium's TIBER-BE framework page, which states how TIBER-BE exercises are run on a voluntary three-year cycle and how they relate to mandatory DORA TLPT. Read it before the European material, because it tells you which Belgian entities the programme targets and where the NBB sees the boundary between a voluntary TIBER-BE test and a supervisory TLPT. Then read the ECB's September 2024 paper on adopting TIBER-EU to help fulfil DORA requirements, which explains why the core requirements of the two regimes are treated as compatible. Finally, work through the January 2025 TIBER-EU framework, since the Belgian implementation sits on top of it and the 2025 update changed the process steps, the deliverables and the timelines that the Belgian guide follows.
Read the TIBER-BE National Implementation Guide (2025) alongside the framework, not after it. Mark every point where the Belgian guide sets a national choice, such as how entities are selected, how contracts with providers are structured or how the control team is composed, and list those as your questions. The framework permits national elements as long as the mandatory requirements stay intact, so the Belgian guide is where your interpretation of the European text can differ from local practice.
Confirm the following directly with the TIBER-BE team before you commit budget or staff. Ask whether your institution is eligible for a voluntary test or whether it falls under a mandatory DORA TLPT designation, since the answer determines who initiates the test and whether a voluntary result can stand in for a supervisory one. Ask about timing: when the notification window opens, how the three-year cycle applies to your entity, and how the TIBER-BE calendar fits with your other DORA obligations. Ask about contract structure, including whether the threat intelligence and red team providers are contracted by you, by the NBB, or under a joint arrangement, and who signs the attestation. Confirm any Belgian-specific points in the 2025 guide before treating the European timelines as final for your case.
How DeployOpen works on this
DeployOpen works with institutions preparing for a TIBER-BE test by building and documenting the self-hosted open-source systems that the test will examine and that the organization's own control team will use. We do not lead the test, issue its reports or replace the TIBER-BE team, the threat intelligence provider or the red team testers.
How we scope
- Engagements are fixed-scope, with systems, deliverables and timelines agreed in writing before any work starts.
- We confirm with the institution which in-scope systems and critical functions the TIBER-BE team has identified, so our work matches the agreed scope.
- We ask the institution to confirm the role split between its control team, blue team and any external providers before we begin.
How we build
- We plan, implement, harden and integrate self-hosted open-source platforms inside the institution's own infrastructure, including its cloud accounts or data centers.
- We configure logging, monitoring and alerting so the blue team can show what it detected and when, using the institution's own tooling choices.
- We run security testing of applications, APIs and infrastructure to confirm our build is ready before the red team phase begins.
How we hand over
- We document configurations, architecture, access records and change history so the institution can present its evidence to the TIBER-BE team.
- We prepare the control and blue team evidence packs that show how the institution's controls were set up, operated and monitored.
- We hand over runbooks and documentation so the institution's own staff can operate and maintain the systems after the engagement ends.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the engagement closes.
- We can support remediation work arising from the test summary report, within the scope agreed in writing.
- Confirm with the TIBER-BE team which documents and contacts apply to your institution before you engage any provider.
