What TIBER-DE is and who runs it in Germany
If a supervisor, customer or contract asks your organization for a threat-led test, TIBER-DE is the German route to that test. TIBER-DE is the Deutsche Bundesbank's implementation of the European framework TIBER-EU, and the Bundesbank's TIBER Cyber Team runs it for voluntary tests and for DORA threat-led penetration testing (TLPT) mandated by BaFin, the ECB or other competent authorities. In August 2019 the Bundesbank and the Federal Ministry of Finance decided to implement TIBER-EU in Germany as TIBER-DE, and German financial entities have been able to test under it since 2020. The Bundesbank operates the test process, but it does not own your controls or your response to the findings. Your organization owns both.
The roles split clearly. The tested entity owns its controls, its control team and blue team, and its remediation plan. The TIBER Cyber Team coordinates the test process and holds the operational responsibilities defined in the framework. Decisions about whether an entity must test, and about the status of a test as a DORA TLPT, sit with the competent supervisor. For voluntary TIBER-DE tests, the Bundesbank states that participation is not a supervisory instrument, and supervisory involvement is agreed individually. Confirm in writing which authority is the competent supervisor for your entity before you accept any scope, because that determines whether your test counts as a mandatory TLPT.
The July 2025 implementation document, version 4.0 of the Bundesbank's TIBER-DE implementation document, states that the German implementation no longer needs national adaptation of test components. The TIBER-EU framework's content applies directly and fully to TIBER-DE tests. Practically, this means the framework's requirements and deliverables are the reference for your procurement, scoping and reporting. Ask your provider and the TIBER Cyber Team to confirm which version of the framework and which German document apply to your test, and request the current contacts, tiber@bundesbank.de for TIBER-DE questions and tlpt@bundesbank.de for DORA TLPT questions, before planning your timeline.
Voluntary TIBER-DE tests versus mandatory DORA TLPT
A voluntary TIBER-DE test is started by the financial entity itself, and the Bundesbank aims it primarily at large and critical German financial entities. The Bundesbank states that participation is voluntary and is not a supervisory instrument, so a voluntary test does not replace or satisfy a supervisor's order. The entity chooses to test, and the TIBER Cyber Team at the Bundesbank runs the process under the TIBER-EU framework. Supervisory involvement is not fixed in advance. The implementation document says it is agreed individually for each voluntary test.
- Who identifies the entity: the financial entity decides to take part and approaches the TIBER Cyber Team.
- Who validates scope: the TIBER Cyber Team and the entity agree the scope, with the entity's critical or important functions at the centre.
- Supervisory involvement: agreed individually. Ask the TIBER Cyber Team early whether and how your supervisor will be informed.
- Final report and remediation plan: the entity owns its results and decides how they are shared, subject to the terms agreed for that test.
- Cost and effort: the entity pays for its own preparation, its internal teams and its external providers.
Before you start, confirm in writing with the TIBER Cyber Team (tiber@bundesbank.de) how supervisory involvement is handled for your entity and how results will be stored and shared.
A mandatory DORA threat-led penetration test is ordered by a competent authority. In Germany the Bundesbank's TIBER Cyber Team is operationally responsible for DORA TLPT mandated by BaFin, by the ECB or by other authorities such as state stock exchange supervisors. The entity does not choose whether to test. The supervisor identifies it, and the test is run through the TIBER Cyber Team, which the entity contacts at tlpt@bundesbank.de. Because the order comes from a supervisor, the supervisor keeps a defined role throughout.
- Who identifies the entity: the competent supervisor (BaFin, the ECB or another authority) decides which entities must test.
- Who validates scope: the competent supervisor validates the scope before testing starts.
- Supervisory involvement: defined by the mandate. The supervisor is involved at the points set by the process and communication is generally routed through the TIBER Cyber Team.
- Final report and remediation plan: the competent supervisor receives the final report and the remediation plan.
- Cost and effort: the entity still carries its own preparation, internal and external costs. Ask the TIBER Cyber Team which costs apply to a mandated test.
Once you receive an order, confirm the supervisor, the scope sign-off steps and the reporting route in writing before engaging any provider.
The two situations differ most in who sees the final report and remediation plan. For a mandatory test, the competent supervisor receives both documents. For a voluntary test, the entity controls the outcome, and the supervisor's view depends on the arrangement agreed for that test. Because TIBER-EU tests do not produce a pass or fail result, the reports are used to strengthen the entity's cyber maturity rather than to grade it, but the recipients still matter for how findings are acted on and remembered.
- Mandatory test: the final report and remediation plan go to the competent supervisor.
- Voluntary test: the entity holds the results, and any sharing with a supervisor is agreed individually.
- Same test content: the framework's requirements apply in both cases, so the technical work does not change with the route.
- Remediation ownership: in both cases the entity owns and funds remediation of the weaknesses it identified.
- Records: keep the scope, sign-off and distribution records for each test so you can show who received which document.
Before a test begins, write down the distribution list for each report and get the TIBER Cyber Team to confirm it.
Supervisory involvement is where the two routes diverge most in practice. In a mandatory test the supervisor's role is set by the order, and the TIBER Cyber Team coordinates communication. In a voluntary test there is no default supervisory role, so the entity and the TIBER Cyber Team agree it individually. Entities that want to avoid surprises should settle this before scoping starts, not during the test.
- Early contact: raise the question of supervisory involvement with the TIBER Cyber Team at first contact.
- Written agreement: record the agreed level of involvement, the points at which the supervisor is informed and who makes that contact.
- Internal alignment: make sure your compliance, risk and board reporting lines know whether a supervisor will see results.
- Changes of status: if a voluntary test is later relevant to a supervisory decision, confirm with the TIBER Cyber Team how that changes the arrangement.
- Independent advice: a legal or compliance adviser can check the wording of any agreement before you sign.
Ask the TIBER Cyber Team for the agreed supervisory arrangement in writing before any external provider is procured.
The generic threat landscape and the targeted threat intelligence report
For TIBER-DE tests, the Bundesbank's TIBER Cyber Team uses the option the TIBER-EU framework offers to provide a generic threat landscape report on the German financial sector. This report describes the threat environment facing the sector as a whole, and it is the starting point for the entity-specific work that follows. Because the report is sector-wide, it does not replace the analysis of your own organization. Ask the TIBER Cyber Team early which parts of the landscape report are shared with you, when it becomes available, and what it covers, so that your preparation and scoping timeline accounts for it.
The targeted threat intelligence report is specific to the tested entity. It is written by the threat intelligence provider you procure during the preparation phase, using the generic landscape as a basis and the context you supply. Your role here matters. Prepare an accurate picture of your critical or important functions, the systems that support them, your third-party dependencies, and the threat scenarios your teams already monitor. Decide in advance who in your organization will answer the provider's questions, and agree how sensitive material will be shared. Weak context produces a generic report, and a generic report gives the red team a weaker starting point.
Before you accept the targeted report, check that it is traceable to the scope specification and that the scenarios it selects are ones the control team can defend. The provider writes the report, but the TIBER Cyber Team and test manager review it under the framework's governance, and the control team should confirm that the flags and scenarios reflect your real exposure. Confirm the review steps, the approval points and the handling rules for the report with the TIBER Cyber Team before testing starts, since these are the decisions that shape what the red team will attempt.
What a German entity should have in place before a TIBER-DE test
A TIBER-DE test puts your detection and response capability under a real, controlled attack, so the work that matters happens before the red team starts. The cards below cover the people, decisions and evidence the framework expects you to have ready, and the items to confirm with your supervisor or the TIBER Cyber Team before the preparation phase begins.
Named control team and blue team
The control team supervises the test on the entity side, and the blue team is the staff who detect and respond to the red team without knowing the scenario in advance. Name both groups early, confirm who holds authority to stop the test, and decide how confidentiality is kept between the control team and the blue team. Ask the TIBER Cyber Team how it expects these roles to be documented in the initiation documents.
Agreed risk management approach
Every TIBER-DE test needs a written risk management approach that defines how the red team avoids harm to live production services, data and third parties. Agree the escalation path, the criteria for pausing an action, and the handling of any personal or client data the testers may touch. Confirm the approach with the TIBER Cyber Team before procurement, since the testers must work within it.
Scope of critical functions and flags
Identify the critical or important functions the test will cover and the flags the red team will try to reach, such as access to a payment or settlement system. The scope specification must be precise enough to test, yet it must not reveal the scenario to the blue team. Check the proposed scope with your supervisor, because for mandatory DORA TLPT the supervisor validates it.
Mature ICT control set
A threat-led test assumes controls already exist and are operating. Review your identity, privileged access, logging, patching and incident response processes against the cybersecurity standards the Bundesbank recommends, namely BSI IT-Grundschutz or ISO/IEC 27001. Their effectiveness is usually only proven by a real attack, so the test is a check on controls you can already describe and evidence, not a substitute for them.
Plan for purple teaming
Purple teaming is mandatory under the 2025 TIBER-EU framework, so plan it before the test rather than after the reports arrive. Decide which red team techniques the blue team will walk through together, who attends, and how findings feed the remediation plan. Ask the TIBER Cyber Team whether the purple teaming schedule must fit within the closure phase timelines in the framework.
Evidence of current controls
Assemble current, dated evidence for the controls in scope, such as configuration baselines, access reviews, log coverage reports and recent incident records. Testers and the authority will compare the test results against what you claim to operate, so out-of-date evidence weakens the closure phase. Confirm with your supervisor which evidence set they expect for the final report and remediation plan.
How a TIBER-DE test runs from notification to attestation
A TIBER-DE test moves through three framework phases, each closing with a defined output that the Bundesbank TIBER Cyber Team, the tested entity and the supervisor can check. Read in order, the sequence shows what the entity must prepare, when external testers start, and what the entity keeps after the attestation.
Receive written notification and start the test
The test begins when the authority gives the entity written notification, which starts the preparation phase. For a voluntary TIBER-DE test, the entity and the Bundesbank TIBER Cyber Team agree how supervisory involvement will work, since the Bundesbank treats it as an individual arrangement. For mandatory DORA TLPT, the competent supervisor identifies the entity and the TIBER Cyber Team usually routes communication. The step closes with initiation documents agreed by both sides, which set the roles and the start of the preparation clock. Ask the TIBER Cyber Team which contact channel and document set it will use for your case.
Set up the control team and scope the test
The entity appoints its control team, which manages the test for the organization and keeps its risk under control, and it defines the scope. The entity identifies its critical or important functions and the flags, which are the targets the red team will try to reach. The scope specification document records these choices and the risk management arrangements for the test. The step closes when the TIBER Cyber Team and the test manager have reviewed and accepted the scope. Confirm with the authority who signs off the scope if your entity is subject to mandatory testing.
Procure threat intelligence and red team providers
The entity procures a threat intelligence provider and red team testers that meet the framework's requirements for service provider procurement. The control team runs the procurement, and the TIBER Cyber Team and test manager review the choice. Providers must be independent of the entity's existing service relationships and must work under the agreed confidentiality and risk arrangements. The step closes with signed contracts and the providers' confirmed roles. Ask each provider for evidence of its testing experience and its handling of risk, and confirm which costs the contract covers.
Produce the targeted threat intelligence report
The threat intelligence provider prepares a targeted threat intelligence report on the entity. In Germany, the Bundesbank TIBER Cyber Team can supply a generic threat landscape report on the national financial sector, which the provider uses as a basis for the entity-specific analysis. The provider selects the threat scenarios that the red team will test against the flags. The control team and test manager review the report before testing begins. The step closes with an approved targeted threat intelligence report and the scenarios for the red team test plan.
Approve the red team test plan and run active testing
The red team testers write the red team test plan based on the approved scenarios and the flags. The control team and test manager supervise the plan before testing starts, and the blue team at the entity is not told the details of the active attack. Active red team testing then runs for at least 12 weeks against the flags under the supervision of the control team and test manager. The step closes when active testing ends, with the red team test report in preparation. Keep a record of every change made to the plan during testing, since the closure phase depends on it.
Compile the red and blue team reports and run replay
Within the closure phase, the red team testers deliver the red team test report, and the blue team at the entity delivers the blue team test report on what it detected and how it responded. The replay brings both teams together to walk through the attack step by step, and the purple teaming session then tests the entity's controls with the red team working alongside the blue team. The framework sets these activities within 10 weeks of the end of active testing. The step closes when both reports and the purple teaming outputs are complete. Ask the TIBER Cyber Team for the guidance documents on each report before drafting them.
Gather 360 degree feedback and issue the test summary
The closure phase includes 360 degree feedback, which gathers views from the staff and teams involved in the test about how it ran and what it showed. The test manager compiles the test summary report, which records the test's strengths and weaknesses. The framework does not give a pass or fail result. The step closes with a finished test summary report that the authority receives for its assessment. Check that the report covers the findings from both the red team and blue team reports.
Deliver the remediation plan and attestation
The entity writes a remediation plan that sets out how it will address the weaknesses found in the test. The framework sets this deliverable within 8 weeks of the authority's assessment. For mandatory DORA TLPT, the competent supervisor receives the final report and the remediation plan. The test closes with the attestation, which confirms the test was carried out under the framework. The remediation plan then becomes the working record for the entity's cyber maturity improvements until the next test, which the framework treats as a three year norm.
Who owns what in a TIBER-DE test
A TIBER-DE test involves several parties with separate jobs, and the entity that is tested carries most of the decisions and most of the follow-up work. Knowing who owns each part, and who only supports or attests, prevents gaps in scope, procurement and remediation.
The tested entity
The financial entity owns its controls, its control team, its blue team and the remediation plan that follows the test. It also procures the threat intelligence provider and the red team testers under the framework's procurement guidance, so it must check that each provider is independent and suitable before signing. Ask who inside the organization signs off scope, who can stop active testing, and who owns the remediation deadlines. The entity remains accountable for its controls throughout.
The control team
The control team is the small group inside the entity that manages the test from its side. It knows which live systems are in scope, coordinates with the TIBER Cyber Team and the test manager, and keeps the test under risk management so that business operations are not disrupted. The 2025 framework renamed the former White Team to the Control Team. Confirm its members, its decision rights and how it records what it knows about the test.
The blue team
The blue team is the entity's own defenders, who detect and respond to the red team's activity without being told in advance which actions are part of the test. Its reports show what was detected, what was missed and how quickly it responded. Those reports feed the blue team test report in the closure phase. Check that the blue team knows its reporting obligations and that its monitoring covers the systems named in the scope.
The TIBER Cyber Team
The TIBER Cyber Team sits in the Bundesbank's Directorate General Payments and Settlement Systems and is operationally responsible for voluntary TIBER-DE tests and for DORA TLPT mandated by BaFin, the ECB or other authorities. It is the first point of contact for entities, and it runs the test manager role on the authority side. Use tiber@bundesbank.de for voluntary TIBER-DE questions and tlpt@bundesbank.de for mandatory DORA TLPT matters.
The supervisor
For mandatory DORA TLPT, the competent supervisor identifies the entities that must test, validates the scope and receives the final report and remediation plan, with communication generally routed through the TIBER Cyber Team. For voluntary TIBER-DE tests, supervisory involvement is agreed individually for each case. Participation in voluntary TIBER-DE is not a supervisory instrument. Confirm early which role the supervisor plays in your test.
Threat intelligence and red team providers
The threat intelligence provider prepares the targeted threat intelligence report and the scenarios. The red team testers plan and execute the active attacks against the flags under control team supervision, and they write the red team test report. Both are selected by the entity through procurement, and neither issues the test attestation. Ask each provider how it documents its independence, its tooling and its handling of sensitive test data.
How to choose threat intelligence and red team providers for a German test
For a TIBER-DE test, the entity itself procures the threat intelligence provider and the red team testers, and it does so under the service provider guidance that the ECB published with the 2025 TIBER-EU framework. Before issuing any tender, confirm the provider requirements with the TIBER Cyber Team at the Bundesbank (tiber@bundesbank.de for voluntary tests, tlpt@bundesbank.de for DORA TLPT), because the framework sets the minimum while national expectations on qualifications, certifications and reporting can add to it. The procurement is a one-time cost for each test, but the choice of providers shapes the quality of every later deliverable, so it deserves more time than the price comparison alone.
Start with independence. The threat intelligence provider and the red team testers must not be the entity's regular security service providers, its managed security operator or the team that built its controls, because the test is meant to show how the entity's own defenses perform. Ask each bidder to describe any existing contracts with the entity, any role in building or running the systems in scope, and how it will separate the people who gather threat intelligence from the people who attack. For a DORA TLPT, ask the TIBER Cyber Team how the competent supervisor will verify these points before the scope is validated.
Next, check experience with the framework's deliverables rather than with generic penetration testing. Ask for sample documents or redacted examples of a targeted threat intelligence report, a red team test plan and a red team test report, and check that the bidder can explain how each one feeds the blue team report, the replay and the purple teaming step. Then align the contract with the closure timelines: active testing runs for at least 12 weeks, replay and purple teaming follow within 10 weeks of its end, and the remediation plan is due within 8 weeks of the authority's assessment. Require the bidder to commit to named staff and to a milestone plan that fits these windows, and make sure the contract covers delays caused by the authority's or the control team's review.
Questions about TIBER-DE, cost and readiness
Who can request a TIBER-DE test?
Participation in TIBER-DE is voluntary and aimed primarily at large and critical German financial entities. Requests and eligibility are handled through the Bundesbank's TIBER Cyber Team, which you can reach at tiber@bundesbank.de. Supervisory involvement for a voluntary test is agreed individually, so confirm early whether your supervisor expects to be informed. The Bundesbank states that TIBER-DE is not a supervisory instrument, so a voluntary test does not replace any test your supervisor requires. If you are unsure whether your entity falls within the target group, ask the TIBER Cyber Team before preparing a budget or a scope.
Is TIBER-DE the same as DORA TLPT?
No. TIBER-DE is the German implementation of the TIBER-EU framework, and it can be run voluntarily. DORA threat-led penetration testing (TLPT) is a supervisory requirement, and in Germany the TIBER Cyber Team is operationally responsible for DORA TLPT mandated by BaFin, the ECB or other authorities. The method is the same because TIBER-EU's core requirements match DORA TLPT, so a well-run TIBER-DE test follows the same phases. The difference lies in who identifies the entity, who validates scope and who receives the final report and remediation plan. Ask the TIBER Cyber Team which category applies to you before committing to a timeline.
Does a TIBER-DE test pass or fail?
A TIBER-DE test does not produce a pass or fail result. The framework is designed to show strengths and weaknesses so the entity can raise its cyber maturity, and the red team and blue team reports, replay, purple teaming and remediation plan are the main outputs. The framework also treats an interval of three years between tests as the norm because of the resources involved. Be cautious with any provider or internal stakeholder who describes a test as a certification. Your remediation plan is the artifact that shows what you will fix, and it is what your supervisor typically reviews.
How much does a TIBER-DE test cost, and what drives it?
No published price for a TIBER-DE test was supplied, so ask for figures in writing rather than relying on estimates. Costs fall into three groups: the threat intelligence provider, the red team testers, and your own internal effort for the control team and blue team. Under TIBER-EU, the entity procures the providers, so the cost of external testers and threat intelligence is paid by your organization. Cost rises with the number of flags, the depth of scenarios, the length of active testing and the number of systems in scope. For a quote, ask for a breakdown by phase, a list of assumptions, what is excluded, and which costs recur if the test is repeated. DeployOpen does not publish prices and quotes follow from the written scope.
How long does a TIBER-DE test take?
Use the framework durations as your planning baseline. The preparation phase lasts up to six months from the authority's written notification. The testing phase includes at least 12 weeks of active red team testing against the flags. The closure phase runs replay and purple teaming within 10 weeks of the end of active testing, and the test summary report and remediation plan are due within 8 weeks of the authority's assessment. Procurement and scoping usually take a large share of preparation, so start early. Confirm with the TIBER Cyber Team how these windows apply to your specific test and whether any DORA deadlines overlap.
Can we run a TIBER-DE test ourselves?
Not fully. TIBER-EU requires external providers for the threat intelligence and the red team testing, and the TIBER Cyber Team and test manager at the authority supervise the process. Your organization owns the control team, the blue team and the remediation work. Internal staff can prepare the scope, collect asset information, run the blue team response and deliver the remediation plan. An implementation partner such as DeployOpen can help prepare systems, logging, access controls and evidence for the test, but it cannot act as the independent red team or issue the test reports. Confirm the roles in writing before procurement begins.
Who issues the TIBER-DE report or attestation?
The entity owns the test outcome, but the test is not issued as a certificate. The closure phase includes an attestation, and the TIBER Cyber Team and the tested entity handle the reports and remediation plan according to the framework. Independent auditors and certification bodies issue audit reports and certifications for other frameworks, and no DeployOpen work product replaces them. DeployOpen prepares systems, controls and evidence but does not issue reports, attestations or certifications. Ask the TIBER Cyber Team which documents your supervisor will expect, and who signs each one.
What does a TIBER-DE test need from our team?
A TIBER-DE test needs named people with clear authority across several functions. Expect to assign a control team lead who can make decisions about risk and test handling, a blue team that monitors and responds during testing, and owners for the systems in scope. Your team should also prepare asset inventories, network documentation, logging coverage and an escalation path that defines how the control team stops or pauses the test. Plan for time from these roles during preparation, testing and closure, including the 360 degree feedback and remediation work. Confirm the time commitment in the scope before work starts.
How DeployOpen prepares systems and evidence for a TIBER-DE test
DeployOpen works on the systems and evidence around a TIBER-DE test, not on the test itself. The Bundesbank TIBER Cyber Team runs the process, the tested entity owns its controls, and an independent testing provider performs the red team work. DeployOpen plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure so that the entity can show its defenses and records in a structured way.
How we scope
- Our written scope lists the platforms, environments and control areas we prepare for the entity's TIBER-DE test.
- Scope is fixed and agreed in writing before work starts, with deliverables and timelines stated in the document.
- We confirm with the entity and the TIBER Cyber Team which parts of the environment are in the test's scope and which are excluded.
How we build
- We implement or harden self-hosted open-source platforms inside the client's cloud accounts, data centers or air-gapped networks.
- We configure logging, monitoring and access records so that detection and response activity can be reconstructed afterward.
- We integrate the platforms with the entity's existing identity, ticketing and incident processes, and confirm the setup with the client's own teams.
How we hand over
- We document configurations, data flows and control owners in a form the control team can use during the test.
- We deliver runbooks and evidence records that show how each platform was set up, tested and changed over time.
- Handover includes a review session where the entity's staff confirm they can operate and explain the platforms without us.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
- Retainers can keep documentation current between TIBER-DE test cycles, which typically recur at intervals the entity agrees with its authority.
- Confirm with DeployOpen in the quote which support tasks are included, and which remain with the entity's own teams.
