What TIBER-ES asks of a Spanish entity and who pays for it
A Spanish financial entity, or a group with Spanish operations, that asks whether it should run a threat-led test should start with one fact: TIBER-ES is voluntary. The Banco de Espana's Executive Commission approved adoption of TIBER-EU as TIBER-ES in December 2020, and the Banco de Espana owns it, with the CNMV and the DGSFP assisting for entities in their fields of competence. The tested entity bears all of the costs and risks, in every case, and never the authorities. Eligibility, cost and scope then depend on the entity's size, its cyber maturity and its sector. The guide says the framework is particularly relevant for the most significant institutions, including large banks, insurers, asset managers and critical financial market infrastructures. Any entity may ask, but the TIBER Cyber Team may accept or deny the request, and it may point a less mature entity toward simpler tests with lower costs and risks.
Because the guide says the requirement to use external providers makes TIBER tests expensive, the largest cost items are the threat intelligence provider and the red team testers, which the entity must procure itself. Ask any prospective provider for a written scope that separates the threat intelligence work, the red team engagement, the purple teaming and the closure reports, and confirm which of these the entity must pay for directly. Also confirm with the Banco de Espana, through the CNMV or DGSFP if the entity falls under their supervision, how the TIBER Cyber Team assesses requests, what information it needs, and whether the entity's own internal effort (control team time, blue team time, and remediation work) is counted in its planning. Those internal costs are real even though no fee is charged to the authority.
Roles stay separate throughout. The organization owns its controls, its test outcomes and the remediation plan that follows. A partner can prepare systems, logging, environments and evidence for the control team and blue team, but it does not decide what the test concludes. Only the authority attests that a test meets the framework, and the TIBER Cyber Team monitors each test on its behalf. Before committing, the board or executive sponsor should record who in the entity holds accountability for the test, who approves the scope, and how the entity will fund remediation after the test summary report is issued.
Who is eligible for a TIBER-ES test and who should not ask
TIBER-ES is voluntary, and the Banco de Espana, CNMV and DGSFP decide which requests go ahead. The cards below set out the profiles the guide treats as the best fit, the signals that point to a simpler test, and what to confirm before writing to the TIBER Cyber Team.
Systemic or significant institutions
The TIBER-ES guide says the framework is particularly relevant for the most significant or systemic institutions, including large banks, insurers and asset managers, and critical financial market infrastructures. Before requesting a test, confirm your organization's systemic weight in its sector and whether your supervisor already regards it as significant. An entity outside these groups should expect the team to ask why a full TIBER-ES test is needed.
Sufficient cyber maturity
The guide says tests are advisable only for systemic entities or those with a certain cyber maturity. A full test assumes that detection, response and remediation processes already exist, because the blue team and control team must be able to respond and the closure phase must lead to real improvements. Check whether you run monitoring, incident response and vulnerability management with documented owners before you apply.
Less mature entities and simpler tests
Entities with limited detection or response capability can find weaknesses through simpler tests at lower cost and lower risk, according to the TIBER-ES guide. A full TIBER-ES test depends on external providers and a multi-phase process, so it can expose an organization to more operational risk than it can handle. Ask your supervisor or the TIBER Cyber Team which lighter assessment fits your current maturity before submitting a formal request.
Acceptance or refusal by the team
The TIBER Cyber Team may accept or deny any test request, and the guide does not promise acceptance to every applicant. Denial is a supervisory judgment about fit, not a finding about the organization's security. Prepare a short written statement of your systemic role, your existing testing history and the reasons you want a test, so the team can assess the request on its merits.
Any entity may ask
The guide says any entity may ask to be tested, so the request route is open even when eligibility is uncertain. Requesting a test does not mean it will proceed, and costs and risks fall on the tested entity in every case. Confirm with the CNMV or DGSFP if your activity falls within their fields of competence, since they assist the Banco de Espana for entities under their supervision.
Costs before you ask
The guide notes that the requirement to use external providers makes TIBER tests expensive, and that the tested entity bears these costs and risks. Before requesting a test, estimate internal staff time for the control team and blue team, and ask potential providers for a written scope. A request made without budget approval often stalls later in procurement.
Who is paid for what in a TIBER-ES test
This table compares each party in a TIBER-ES test by who pays them, whether the cost is one-time or recurring, and what drives it up. Read it as a checklist for requesting written quotes, since the Banco de Espana guide does not publish fee levels. The main takeaway is that external provider requirements make these tests expensive, and the tested entity carries those costs and risks in every case.
| Party | Who is paid and by whom | One-time or recurring | What drives it up |
|---|---|---|---|
| Internal control team and blue team | Paid by the tested entity through existing staff budgets or internal cost allocation. The authority does not fund these roles. | Largely one-time for the test, with recurring effort for remediation follow-up | Number of staff released from normal duties, the number of flags and systems in scope, and the depth of blue team reporting |
| Threat intelligence provider | Engaged and paid by the tested entity under a contract. The TIBER-ES guide requires external providers. | One-time per test | Breadth of the targeted threat intelligence report, the number of scenarios, and the sector and geographic specificity requested |
| Red team testers | Engaged and paid by the tested entity under a contract. The TIBER-ES guide requires external testers. | One-time per test, covering at least the active testing period | Length of active testing, number of flags and attack surfaces, and the scope of physical or social engineering components |
| External programme or test management support | Optional support paid by the tested entity if it hires advisers for project management, documentation or procurement. This is not a role the framework requires the entity to buy. | One-time for a single test, or recurring if engaged across a multi-year cycle | Whether the entity has in-house TIBER experience, the number of parties to coordinate, and how much document preparation is outsourced |
| Authority's supervisory role (Banco de Espana, CNMV, DGSFP) | Not paid by the tested entity as a fee in the sources reviewed. Confirm any charges directly with the TIBER Cyber Team before scoping. | Recurring across the programme, with per-test involvement | Number of tests the team monitors, and the level of attestation and Knowledge Centre participation required for each test |
| Costs and risks of the test overall | Borne in all cases by the tested entity, never by the adopting authorities, according to the TIBER-ES guide. | Both one-time and recurring across the testing cycle | Choice of providers, the complexity of the scope, and the remediation the test reveals |
How a TIBER-ES test moves through preparation, testing and closure
The sequence runs from the authority's written notification to a signed attestation, with each phase producing a defined set of documents that the TIBER Cyber Team reviews before the next phase starts. The Banco de Espana, CNMV and DGSFP coordinate it, while the tested entity carries the cost and the risk throughout.
Notify the entity and open the preparation phase
The TIBER Cyber Team sends the entity a written notification that a test will take place, which starts the preparation phase. The entity then confirms its point of contact and, with the authority responsible for it, begins initiation. The preparation phase lasts up to six months from that written notification. It is complete when the initiation documents are agreed and the authority has accepted the scope and procurement plan. Ask the authority how it expects the notification and initiation to be documented before the first meeting.
Set up the control team and risk management
The entity appoints a control team, which the 2025 framework renamed from the White Team, to manage the test from inside the organization. The control team holds the knowledge of live scope and keeps the blue team unaware of the test while protecting systems and data. Risk management arrangements are agreed at this stage, including how the test could affect production services. The step is done when the control team roles and risk controls are documented and accepted by the TIBER Cyber Team.
Agree scope, critical functions and flags
The entity identifies its critical or important functions and the flags, which are the targets the red team will try to reach. The scope specification document records these functions, the systems supporting them, and the boundaries of the test. The TIBER Cyber Team reviews the scope before it is approved. This step closes with an approved scope specification document, which becomes the reference for every later phase.
Procure threat intelligence and red team providers
The entity procures a threat intelligence provider and red team testers from external suppliers, because the framework requires external providers. Procurement follows the guidance on service provider procurement and must satisfy the authority's requirements. Costs are paid by the tested entity, and the Banco de Espana's guide notes that this requirement makes TIBER tests expensive. The step is complete when contracts are signed and the authority has confirmed the providers meet its requirements.
Produce targeted threat intelligence and the red team plan
The threat intelligence provider prepares a targeted threat intelligence report that identifies the threat actors and scenarios relevant to the entity. The red team then drafts a red team test plan describing how it will reach the flags. The TIBER Cyber Team and the test manager review both documents with the control team before testing starts. The testing phase begins once these documents are approved.
Run at least 12 weeks of active red team testing
The red team carries out attacks against the flags for at least 12 weeks under the supervision of the control team and the test manager. The blue team defends the entity without knowing the test is underway, and its detection and response activity is recorded. Active testing ends when the red team stops, and that end date sets the deadline for the closure phase. The step closes with the red team test report and the blue team test report starting to take shape.
Replay, purple team and gather 360 degree feedback
Within 10 weeks of the end of active testing, the entity completes the red and blue team reports, a replay of key attack paths, and purple teaming, where red and blue teams work together to improve detection and response. 360 degree feedback is gathered from the people involved in the test. These outputs feed the test summary report. The step is done when the reports, replay results and purple teaming outputs are delivered to the TIBER Cyber Team.
Issue the summary, remediation plan and attestation
The entity prepares a test summary report and a remediation plan within 8 weeks of the authority's assessment, and the TIBER Cyber Team confirms the test meets the framework. The attestation is then issued, confirming the test was carried out under TIBER-ES. TIBER-EU tests do not produce a pass or fail result, so the outputs show strengths and weaknesses for the entity to act on. Ask for the attestation template and the remediation tracking method before the closure phase begins.
Who does what: the entity, its partner and the authority
The tested entity owns the test from start to finish. It is accountable for its controls, for the decisions made during scoping, and for how it responds to what the test finds. Under TIBER-ES, the entity sets up its own control team and blue team, funds the engagement, and decides how to fix the weaknesses identified in the remediation plan. The authority does not pay for the test, so the entity should expect the full cost of the external providers to sit on its budget.
- Control team: the entity appoints people who know the test, manage information flow to the red team and keep the test safe, without being part of the blue team's day-to-day defence.
- Blue team: the entity's own defenders who detect and respond to the red team's activity without advance knowledge of the scenarios.
- Budget: the entity funds the threat intelligence provider, the red team testers and the internal effort, since costs and risks are borne by the tested entity and never by the authority.
- Remediation decisions: the entity decides which weaknesses to fix, in what order, and under which owners, within the timeline set by the framework.
- Procurement: the entity runs procurement for external providers, so it must confirm that the providers are independent of its own service providers.
Before you start, confirm who in your organization holds each of these roles and what budget line covers external providers.
An implementation partner such as DeployOpen helps the entity get its systems, logging and documentation into a state where a test can be scoped and evidenced. This work happens mainly in the preparation and closure phases, and it is separate from the red team testing itself. The partner does not attest that the framework has been met, and it does not replace the external testers or the authority's role. Where a partner also offers security testing, that role must stay separate from the testers procured for the TIBER-ES test.
- Systems and logging: confirming that the environments in scope produce the logs and telemetry the blue team and the test summary depend on.
- Evidence and documentation: organizing records of controls, architecture and ownership so the entity can answer the authority and the providers without delay.
- Scoping support: helping the entity prepare the input for the scope specification and the list of critical or important functions and flags.
- Readiness work: testing the entity's own detection and response capabilities before the formal test, which the entity then decides whether to share with the test manager.
- Limits of the role: the partner does not issue reports, the attestation or any certificate, and it must not act as the red team or threat intelligence provider for the same test.
Before you engage a partner, ask in writing which tasks it will perform, which it will not, and how it will keep its work separate from the procured testers.
The TIBER Cyber Team for Spain is made up of the Banco de Espana, the CNMV and the DGSFP. The authority responsible for the tested entity coordinates the test, and the team as a whole monitors the test, attests that it meets the framework, and takes part in the ECB's TIBER-EU Knowledge Centre. The team also decides whether to accept or deny a request for a test, so an entity should not assume that asking for one leads to a test.
- Coordination: the authority responsible for the entity leads day-to-day coordination and is the first point of contact for the test.
- Monitoring: the test manager at the authority supervises the phases and checks that each deliverable meets the framework.
- Attestation: the team attests that the test meets the framework requirements, which is a regulatory judgment separate from any report the entity or its partner produces.
- Acceptance decisions: the team may accept or deny test requests, based on whether the entity is systemic or sufficiently mature.
- Knowledge sharing: the team takes part in the ECB's Knowledge Centre, which supports consistent practice across adopting jurisdictions.
Before you request a test, confirm which of the three authorities supervises your entity and who the test manager will be.
What the entity should have in place before asking for a TIBER-ES test
The Banco de Espana's TIBER-ES guide makes participation voluntary and reserves the framework for systemic entities or those with a certain cyber maturity, and the TIBER Cyber Team may accept or deny a request. The six items below are the internal checks an entity should complete before it approaches the authority, because each one shapes whether a request is credible and whether the test can run safely.
Documented ICT risk management baseline
Before a request, confirm that the entity has a current, approved ICT risk management framework with defined owners, a risk register covering its critical information systems, and recorded treatment decisions. TIBER-ES expects tests only from entities with a certain cyber maturity, so a gap in this baseline is often the first thing the authority will examine. Check that the policies are dated, approved by the management body, and reviewed on a fixed cycle, and that the risk register is linked to the systems a red team would plausibly target.
Named control team and governance
Name the control team and its leader before scoping starts. The control team is the internal group that manages the test on the entity's side, keeps the red team's activity known only to those who need it, and reports to senior management. Confirm that the members have the authority to stop or adjust activity, that the reporting line reaches the management body, and that deputies exist so the team does not depend on one person for the length of an active test.
Identified critical functions and flags
Map the critical or important functions the test would cover, and for each one list the flags, meaning the target assets or objectives the red team would try to reach. Confirm which systems, data and business services sit behind each function, and who owns them. Clear ownership makes the scoping document specific, limits surprises, and gives the authority evidence that the entity knows where its most important exposures lie.
Supplier and provider contracts covering test activity
Review contracts with hosting providers, cloud services, managed security providers and other third parties whose systems or staff could be touched during a test. Confirm whether each contract permits penetration testing and red team activity, names who must be notified, and sets the process for emergency contacts. The TIBER-ES guide stresses that the entity bears the costs and risks, so these agreements determine who can be engaged and what legal exposure the entity carries.
Clear procurement route for providers
Decide how the entity will procure the threat intelligence provider and the red team testers before the request is filed. The guide notes that the requirement to use external providers makes TIBER tests expensive, so budget approval, tender rules, conflict-of-interest checks and procurement timelines should be understood in advance. Ask internally which purchasing rules apply, who signs the contract, and whether the entity needs a framework agreement already in place.
Plan for remediation funding
A TIBER-EU test is designed to show strengths and weaknesses so the entity can raise its cyber maturity, which means findings will usually lead to remediation work with real cost. Before asking for a test, agree internally who approves remediation budget, how findings will be prioritized, and how the remediation plan will be tracked to completion. A plan that leaves funding undecided risks a test that identifies problems the entity cannot fund to fix.
Questions buyers ask about TIBER-ES
Is TIBER-ES mandatory for financial entities in Spain?
No, participation in TIBER-ES is voluntary. The Banco de Espana's Executive Commission approved adoption of TIBER-EU as TIBER-ES in December 2020, and the Banco de Espana's guide says the framework is particularly relevant for the most significant or systemic institutions: large banks, insurers and asset managers, and critical financial market infrastructures. Any entity may ask to be tested, but the TIBER Cyber Team may accept or deny requests. Separately, whether an entity must run a threat-led penetration test under DORA is decided by its competent authority. A TIBER-ES test can be part of that picture, so confirm your DORA status with your supervisor before you plan a test or a budget.
Who pays for a TIBER-ES test, and does the authority cover any of it?
The tested entity pays for the test. The Banco de Espana's guide states that costs and risks are borne in all cases by the tested entity and never by the authorities adopting the framework. The guide also notes that the requirement to use external providers makes TIBER tests expensive. The main cost components are the threat intelligence provider, the red team testers, and your internal effort for the control team and blue team, plus remediation work afterwards. Scope size, the number of critical functions and flags, and test length drive the total. When you request a quote, ask for pricing by provider role, the assumptions behind the scope, which items are one-time and which recur, and how scope changes are priced. Under the framework, tests are normally spaced at intervals of three years.
How long does a TIBER-ES test take, phase by phase?
A TIBER-ES test follows the three mandatory phases of TIBER-EU, and each has its own clock. Preparation covers notification, initiation, scoping and procurement, and lasts up to six months from the authority's written notification. Testing starts with targeted threat intelligence and scenario selection, then runs at least 12 weeks of active red team testing against the flags under control team and test manager supervision. Closure begins with the red and blue team reports, replay and purple teaming within 10 weeks of the end of active testing, then 360 degree feedback, the test summary report and the remediation plan within 8 weeks of the authority's assessment, and finally the attestation. Procurement time sits inside preparation, so start that early. Confirm the current schedule against the implementation guide and with the TIBER Cyber Team.
Can a smaller entity with lower cyber maturity request a TIBER-ES test?
Yes, an entity of any size can ask, but the framework does not expect every entity to take a full test. The Banco de Espana's guide says tests are advisable only for systemic entities or those with a certain level of cyber maturity. Less mature entities can usually find weaknesses through simpler tests with lower costs and risks. Because the TIBER Cyber Team may accept or deny a request, a smaller firm should describe its environment, critical functions and current testing history in the request. Ask the authority which lighter test types it would accept for your profile. A scoped security test from an independent provider can be a useful step before a full threat-led exercise, but confirm with the TIBER Cyber Team whether that step is acceptable to them.
How does a TIBER-ES test relate to DORA threat-led penetration testing?
The ECB's September 2024 paper stated that the core requirements of DORA TLPT and TIBER-EU are identical, so a well-run TIBER-EU test is built to the same core requirements. The 2025 TIBER-EU update aligned its process steps with the deliverables and timelines of the DORA technical standards on threat-led penetration testing, and made purple teaming mandatory. Mutual recognition also applies: compliance with the framework's mandatory requirements lets authorities that have adopted TIBER-EU recognize each other's tests, which spares entities operating in several jurisdictions from duplicate tests. Whether a given TIBER-ES test satisfies a specific DORA obligation depends on your competent authority's decision, so get that confirmed in writing before the test starts.
What must our team provide, and what can an external partner handle?
Your organization owns its controls, its test results and its remediation. Five parties take part in a TIBER-EU test: the TIBER Cyber Team and test manager at the authority, the control team and blue team at your entity, and the threat intelligence provider and red team testers. Your internal staff run the control team and blue team, manage risk, and own the remediation plan. External providers supply the threat intelligence and red team work, which the framework requires. An implementation partner such as DeployOpen can prepare systems, controls and evidence and help document them. It does not issue reports or attestations. The TIBER Cyber Team attests that a test meets the framework. Review the roles in the Banco de Espana's implementation guide before you write your scope.
How DeployOpen prepares systems and evidence for a TIBER-ES test
For a TIBER-ES test, the tested entity owns the test and its controls, and the TIBER Cyber Team at the Banco de Espana, CNMV and DGSFP monitors it. DeployOpen prepares the self-hosted open-source platforms, controls and evidence that the entity's own team and procured providers will rely on, inside the entity's infrastructure. We do not issue attestations or replace the independent parties the framework requires.
How we scope
- Written scope, agreed before work starts, listing the systems and controls in the TIBER-ES test.
- Scope mapped to the ECB's scope specification document and the critical functions and flags the entity identifies.
- Fixed scope, with deliverables and timelines in writing before any build work begins; quotes follow from that written scope.
How we build
- Self-hosted open-source platforms deployed in the entity's own cloud accounts, data centers or air-gapped networks.
- Hardening and access controls set up so the entity can show how each control operates during the test.
- Application, API and infrastructure security testing scheduled before the active red team phase, if the entity commissions it.
How we hand over
- Documentation of configurations, architecture and operating procedures, delivered to the entity's control and blue teams.
- Evidence packs organized by TIBER-EU deliverable, which the entity shares with the authority and its own providers.
- Confirm in writing who prepares each report, since DeployOpen does not issue attestations or audit reports.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer, which the entity can scope for work between test cycles.
- Platform changes from the remediation plan are documented, then retested under the agreed scope.
- Confirm with the Banco de Espana whether any DeployOpen role fits the rules on external providers before scoping.
