How does TIBER-EU SSM work for a significant bank under ECB supervision?
The ECB is the TLPT authority for significant institutions under DORA Articles 26 and 46, and its TIBER-EU SSM guide (2025) sets out how it runs those mandatory tests. A significant bank facing a DORA threat-led penetration test does not negotiate the method with its national authority. The ECB identifies the institution against criteria on systemic importance, business impact and ICT risk profile, keeps the list updated annually, and asks the bank to appoint a single point of contact who joins the control team when the test starts. The ECB's SSM TLPT Cyber Team (TCT-SSM) then assigns the test to itself or to a national TIBER Cyber Team, appoints the test manager and organises the attestation. Questions about the process go to TCT-SSM@ecb.europa.eu, and the bank should confirm its designated contact early.
Cost, timing and scope are not a fixed fee. They depend on the bank's own ICT footprint, including the live production systems, third-party services and critical or important functions in scope, and on the terms of the contracts the bank signs. The control team arranges and budgets for procurement of the threat intelligence provider and red team testers, and it must not contract a provider the test manager considers unqualified under Article 7(1) of the TLPT standards. The bank should ask for a written scope and budget from each provider, check the contract headings the TIBER-EU SSM guide lists (confidentiality, forbidden actions, data retention and destruction, breach notification, liability and conflicts of interest), and confirm with the ECB how the timing of its mandatory test is counted.
How the ECB identifies significant institutions and appoints a single point of contact
This sequence shows how the ECB decides which banks must run a DORA threat-led test, how that decision reaches the bank, and how the bank names the person who joins the control team when testing starts.
Ecb assesses institutions against identification criteria
The ECB screens its supervised significant institutions using criteria on systemic importance, business impact and ICT risk profile. The assessment is carried out by ECB Banking Supervision, which is the competent authority and TLPT authority for significant institutions under DORA Articles 26 and 46. The output is a decision on which institutions fall within mandatory TLPT. Ask your Joint Supervisory Team which criteria were applied to your institution and what information was used to assess your ICT risk profile.
Ecb publishes the annually updated list
The ECB keeps a list of significant institutions subject to mandatory TLPT and updates it annually. Institutions appear on the list because the ECB has identified them, not because they have requested inclusion. The output is an updated list that determines which entities are notified. Confirm with your Joint Supervisory Team whether your institution is on the current list, and do not assume your status from last year's position.
Institution receives notice of its TLPT status
Institutions identified for mandatory TLPT are informed through the supervisory channel. The notice confirms that the institution is in scope for DORA threat-led testing under the ECB's TIBER-EU SSM approach. The output is a written record of the institution's status that the compliance and ICT risk functions can file. Ask the Joint Supervisory Team to confirm the notice in writing and to name the contacts the ECB will use for the test.
Institution appoints a single point of contact
The institution designates one single point of contact for the TLPT. This person is the named link between the bank and the ECB for the test, so the role should sit with an accountable senior owner in the ICT risk or security function. The output is a confirmed name, role and contact details provided to the ECB. Check that the contact details are current, because the ECB and the Joint Supervisory Team will direct test communications to this person.
Single point of contact joins the control team
When the test starts, the single point of contact joins the control team. The control team is the body that supervises the test on the institution's side and that the ECB's test manager works with throughout preparation and testing. The output is a control team that includes the named contact and is ready for the initiation phase. Confirm with the test manager which other roles the institution must staff, and who will act as the contact if the single point of contact is unavailable.
Institution confirms contacts with the ECB and Joint Supervisory Team
Before the test starts, the institution checks its inclusion and every contact detail directly with the ECB and its Joint Supervisory Team, rather than relying on earlier correspondence or assumptions. The output is a written confirmation of the contact list used by the ECB's SSM TLPT Cyber Team, TCT-SSM, which can be reached at TCT-SSM@ecb.europa.eu. Keep the confirmation on file, since it documents that the institution verified its status and contacts.
Who runs the test: TCT-SSM, national TIBER Cyber Teams and test managers
A TIBER-EU SSM test involves several bodies with different jobs, and the bank's own team carries the responsibility for its controls. The cards below set out who assigns the test, who manages it, who supplies the testers and who judges the outcome, so you know who to contact at each stage.
TCT-SSM in the ECB
The ECB's SSM TLPT Cyber Team (TCT-SSM) sits in the Directorate General On-site and Internal Model Inspections and acts as the TLPT authority for significant institutions under DORA. It decides for each mandatory test whether the ECB runs it directly or hands it to a national TIBER Cyber Team. Before your test starts, confirm which body holds the file, since that determines your day-to-day contacts. Direct procedural questions to TCT-SSM@ecb.europa.eu.
Assignment to a national team
TCT-SSM can assign a significant institution's test to itself or to a national TIBER Cyber Team, so a bank may be tested under the ECB's direct control or through the team of its home country. Ask TCT-SSM in writing which route applies and what it means for reporting lines, meeting formats and the people who will sign off the results. Keep that decision on file, because it sets the contacts for every later phase.
Test managers appointed by the authority
The authority appoints the test manager who runs the test on its behalf and checks that the process meets the framework. The test manager also decides whether the threat intelligence provider and red team testers you have procured meet the requirements of Article 7(1) of the TLPT standards. Your control team should plan for this review before signing any contract, because a provider the test manager rejects cannot be used.
Single point of contact in the control team
Each significant institution appoints a single point of contact who joins the control team when the test starts. This person is the bank's named link to the ECB, the test manager and the providers during preparation, testing and closure. Name the role early, confirm the deputy, and make sure the person has authority to commit internal resources and escalate issues to senior management.
Joint Supervisory Team as stakeholder
The Joint Supervisory Team that supervises the bank is a stakeholder in the test, not a passive recipient of the report. It assesses the results and the remediation plan after the test, and its view feeds into the ECB's decision on the attestation. Brief the team early on scope and timing, and agree how findings and the remediation plan will be shared so the supervisory dialogue does not start from scratch after closure.
Attestation organised by TCT-SSM
TCT-SSM organises the attestation that confirms whether the test meets the framework requirements. If requirements are not met, the ECB may decline to issue it, and the test then does not count as DORA TLPT, although the bank may still use it for learning. Ask at the start which evidence the ECB expects for the attestation, and build the closure documents so they can be checked against that list.
Why significant banks may use only external testers under Article 26(8)
Under DORA Article 26(8), a significant institution running a threat-led penetration test may use only external red team testers, and its threat intelligence provider must also be external. This is a hard constraint on who can do the offensive and intelligence work, and it shapes procurement from the first day of the preparation phase. Internal staff are not excluded from the test. They can and usually do sit in the control team or the blue team, where they support scoping, monitor detection and response, and take part in the replay and purple teaming activities. What they cannot do is run the red team operations or produce the targeted threat intelligence that drives scenario selection.
The practical consequence falls on the control team. It is responsible for arranging and budgeting the procurement of the threat intelligence provider and the red team testers, so the bank's own procurement and risk functions need to start early enough to run competitive selection and contracting before the test manager's sign-off. The ECB's TIBER-EU SSM guide says the control team must not contract a provider if the test manager considers that provider does not meet Article 7(1) of the TLPT standards. Build that gate into the procurement timeline as a formal checkpoint, with the test manager's written view recorded before any contract is signed.
Before shortlisting, confirm the tester pool with the ECB through the TCT-SSM (TCT-SSM@ecb.europa.eu) and the Joint Supervisory Team. Ask which external firms the supervisor regards as acceptable for this test, what documentation it expects to see for each candidate, and whether any existing relationship or conflict of interest would disqualify a provider. Providers that have supported the bank's own ICT, audit or remediation work in the same period should be reviewed against the conflict-of-interest requirements before they are approached. Treat this confirmation as a precondition for the procurement plan, not a formality at the end of it.
What provider contracts must settle before testing starts
This table lists the contract topics the ECB's TIBER-EU SSM guide expects providers to settle before a threat intelligence provider or red team tester starts work. For each topic it names who in the bank usually owns the item and what to ask the provider to show, so the control team can check the contract before signing. Treat the table as a checklist for the legal, procurement and security teams, not as a substitute for the guide.
| Contract topic | Usual owner in the bank | What to ask the provider to show |
|---|---|---|
| Infrastructure in scope | Control team with the test manager | A written list of systems, networks and third-party assets the tester may touch, matching the scope specification document |
| Confidentiality | Legal and information security | Non-disclosure terms covering the flags, findings, threat intelligence and staff who see them, with named personnel |
| Timing and availability | Control team and test manager | Agreed test windows, named tester availability and a plan for pausing or extending active testing |
| Forbidden actions | Information security and legal | Explicit list of prohibited actions, such as denial of service or damage to production data, and how the provider confirms compliance |
| Secure channels | Information security | Encrypted communication methods for reports, flags and live updates, plus how credentials and access data are handled |
| Alerting and escalation | Control team and blue team lead | Escalation path for incidents that look real or cause harm, including who the provider calls first and how fast |
| Liability, insurance and languages | Legal, procurement and risk management | Liability caps, insurance cover details and the languages used for deliverables and communication |
| Tester availability | Procurement and control team | Confirmation that named testers meet the eligibility requirements the test manager applies, with replacement terms |
| Data retention and destruction | Data protection officer and information security | Retention periods, destruction method and written confirmation once the test closes |
| Breach notification | Information security and legal | A clear obligation to notify the bank of any breach affecting bank data or systems, with notice timing set in the contract |
| Conflicts of interest | Procurement and compliance | A written declaration that the provider has no conflicts with the bank, its group or its service providers, updated if circumstances change |
How the attestation and the Joint Supervisory Team review decide whether the test counts
This sequence takes a completed TIBER-EU SSM test from the red and blue team reports to a decision on whether the ECB issues an attestation that counts as DORA TLPT. The bank owns the remediation work, the Joint Supervisory Team assesses the results, and the ECB makes the final call.
Complete the red and blue team reports
After active testing ends, the red team testers write their test report and the blue team writes its own account of what it detected and how it responded. Both reports go to the control team and the test manager. The step is complete when the test manager has received both reports and confirmed they cover the flags and scenarios agreed in the scoping documents. The control team owns the bank's side of this work, and the testers own their reports.
Run replay and purple teaming
The control team and blue team go through the red team's attack paths step by step, so the bank can see which activity was detected, which was missed and why. Purple teaming then tests the improvements in the same environment. The step closes when the test manager has the replay findings and the purple teaming outcomes recorded, which feed directly into the test summary report.
Gather 360 degree feedback
The control team collects structured input from the people involved in the test, including those who ran the bank's defenses and those who were tested, so the test summary captures lessons beyond the technical findings. The step is complete when the feedback is documented and passed to the test manager for use in the summary report.
Draft the test summary and remediation plan
The test manager, with the control team, prepares the test summary report, which sets out the overall results, strengths and weaknesses, and the remediation plan that addresses each finding. The bank owns the plan and its deadlines, and it must be specific enough for the Joint Supervisory Team to judge whether the weaknesses are being fixed. The step is complete when the bank submits the summary and plan to the ECB.
Assess results with the Joint Supervisory Team
The Joint Supervisory Team that supervises the bank is a stakeholder in the test and reviews the results and the remediation plan after the test. Its assessment shows whether the bank's proposed actions respond to the findings. The step is complete when the team has given its assessment to the ECB, which is the input the attestation decision depends on.
Decide on the attestation
The ECB, through TCT-SSM, decides whether the test meets the requirements for mandatory DORA TLPT and whether to issue an attestation. If the requirements are not met, the ECB may decline to issue one. The attestation is issued by the ECB only. Neither DeployOpen nor any testing provider issues, signs or influences the attestation as a certifying body.
Confirm whether the test counts for DORA
The bank checks the outcome of the decision with the ECB. If an attestation is issued, the test counts as the mandatory DORA TLPT and its timing applies to the next cycle. If it is not issued, the test does not count as DORA TLPT, but the bank may still continue with the work for learning. The step is complete when the bank has the written outcome and has recorded it for its supervisory file.
Do voluntary TIBER tests count toward a mandatory DORA TLPT?
No. A voluntary TIBER test run by a significant institution does not count as a DORA threat-led penetration test, and it does not count toward the timing of the mandatory test. Under the TIBER-EU SSM guide, a significant institution may still run a voluntary TIBER test through a national TIBER Cyber Team, but only after it has informed the ECB. The test can be useful for learning and for building the internal capability the mandatory test will later demand. It cannot stand in for the test the ECB requires under DORA, and the ECB's attestation of a mandatory TLPT is a separate step that a voluntary exercise does not produce.
The practical risk is a planning error. A bank that schedules a voluntary test in the period when its mandatory TLPT is due may assume the two are interchangeable, then find that the ECB still expects a full TCT-SSM test with its own test manager, external threat intelligence provider and external red team testers. National guides reinforce this boundary. The TIBER-FR guide, for example, states that it does not apply to significant institutions, for which the ECB is the TLPT authority. Read the guide of the national team you are considering with that in mind, and treat its procedures as a voluntary exercise rather than as the mandatory process.
Before you schedule any voluntary test, confirm its status in writing with the ECB, including whether it will be recorded as voluntary, whether it affects the timing of your mandatory TLPT, and which team will supervise it. Send the request to TCT-SSM@ecb.europa.eu and ask your Joint Supervisory Team to confirm the position as well. Keep the written reply with your DORA testing file. If the answer is unclear, ask for it before you sign any provider contract, because the procurement and scoping work for a voluntary test can consume the same internal resources as the mandatory one.
What a significant bank should have in place before the TLPT starts
A significant institution under ECB supervision should have five things ready before the threat-led test begins: a mandate and budget, a named contact, an accurate picture of what is in scope, a clear route to external providers, and monitoring that the red team can actually test. Each card below names the item, who should own it and how to check it.
Governance and budget approval
The board or a delegated senior committee should approve the test, its purpose and the budget before notification. The control team arranges and pays for the threat intelligence provider and red team testers, so the budget must cover external procurement, not only internal staff time. Check that the approval record names the accountable executive, the control team lead and the escalation path if the test must stop. Ask the ECB's TIBER-EU SSM guide which governance decisions it expects to see documented.
Named single point of contact
The ECB requires each significant institution to appoint a single point of contact, who joins the control team when the test starts. This person is the bank's formal link to the test manager and the Joint Supervisory Team, so they need authority to make decisions and access to the executives who approve scope changes. Confirm the appointment is in writing, that a deputy is named, and that the person is not also the red team's internal liaison, which would blur roles during the test.
Current inventory of in-scope systems
Scoping starts from an accurate list of the critical or important functions and the ICT systems that support them, including the third-party services those systems depend on. An outdated asset register is the most common reason scope arguments stall in the preparation phase. Check that each function has a named business owner, that systems are mapped to the functions they support, and that cloud and outsourced components are listed with their hosting locations. Ask the bank's enterprise architecture or ICT risk team to confirm the inventory was reviewed within the last reporting cycle.
Provider procurement readiness
The threat intelligence provider and red team testers must be external, so the bank needs a procurement path that can run in parallel with scoping. Prepare a short list of qualified providers, the standard contract terms the SSM guide lists (infrastructure in scope, confidentiality, forbidden actions, liability and insurance, data destruction, breach notification and conflicts of interest), and a conflict check process. Procurement should be owned by the control team with legal and vendor risk support, and the test manager must agree that candidates meet the tester requirements before any contract is signed.
Logging and incident response readiness
A red team test is only useful if the bank's detection and response processes are real enough to be exercised. Confirm that security logs from in-scope systems are collected centrally, retained long enough to reconstruct an intrusion, and reviewed by a defined security operations function. Check that the incident response plan names roles, decision rights and external notification steps, and that the blue team knows which alerts or actions are authorized to be observed without disrupting the test. Gaps found here are normal, but they should be known before the test rather than discovered during it.
Who does what: the bank, its implementation partner and the ECB
The bank owns its controls, its risk decisions and the test outcome. Its control team and blue team carry the day-to-day weight of the test, and the single point of contact the ECB requires joins the control team when testing starts. The bank also arranges and budgets for procurement of the threat intelligence provider and red team testers, and it must not contract them if the test manager considers they do not meet Article 7(1) of the TLPT standards.
- Control team: Governs the test, manages risk during active testing and works with the test manager on scope, flags and procurement.
- Blue team: Monitors and responds to the red team's activity as it would to a real attacker, and produces its own test report.
- Procurement: Runs the contracts with external providers, covering infrastructure in scope, confidentiality, forbidden actions, secure channels, liability, insurance, data destruction and conflicts of interest.
- Remediation: Owns the remediation plan that the Joint Supervisory Team assesses after the test.
- Outsourcing: System preparation, evidence packs and scoping support can be bought in, but the bank remains accountable for every decision.
Before engaging any partner, confirm with the ECB's guidance which contract terms and tester checks apply to your institution.
An implementation partner such as DeployOpen prepares the bank's systems and evidence so the bank's own teams can run the test efficiently. Preparation work is planned and fixed in writing before it starts. The partner does not decide scope, does not own the controls and does not sign the test outcome.
- System preparation: Hardening, logging and monitoring of in-scope self-hosted open-source platforms, so the blue team has the telemetry it needs.
- Evidence packs: Organizing configuration records, access reviews, change logs and incident records that the control team and assessors will read.
- Scoping support: Documenting systems, dependencies and critical or important functions to inform the scope specification the bank prepares.
- Remediation support: Engineering fixes for weaknesses identified in the test, under the bank's remediation plan.
- Independence boundary: DeployOpen does not act as the external red team or threat intelligence provider unless it is procured as such and the ECB rules allow it. It never issues the attestation.
Ask any partner to state in writing which roles it will not take on, and confirm with the bank's control team that its preparation work does not create a conflict of interest for later testing.
The ECB is the competent authority and TLPT authority for significant institutions under DORA Articles 26 and 46. Its SSM TLPT Cyber Team, known as TCT-SSM and located in the Directorate General On-site and Internal Model Inspections, identifies the institutions that must test, assigns each test, appoints test managers and organises the attestation. The Joint Supervisory Team that supervises the bank takes part as a stakeholder.
- Identification: Applies criteria on systemic importance, business impact and ICT risk profile, and keeps the list updated annually.
- Test management: Assigns each test to TCT-SSM or to a national TIBER Cyber Team and appoints the test manager.
- Joint Supervisory Team: Assesses the test results and the remediation plan after the test, and shapes supervisory follow-up.
- Attestation: The ECB decides whether to issue an attestation. If requirements are not met, it may decline, and the test then does not count as DORA TLPT.
- Contact: Queries go to TCT-SSM@ecb.europa.eu.
Confirm with the test manager which deliverables the JST expects and when, because those dates set the remediation timeline.
Common questions from banks facing a TIBER-EU SSM test
Can our bank run a DORA threat-led test with internal staff?
No. Under DORA Article 26(8), a significant institution may use only external red team testers, and the threat intelligence provider must also be external. Your own staff can take part in the control team and blue team, which manage and defend during the test, but the red team and threat intelligence work must come from outside providers. The control team arranges and budgets for procurement, and it must not contract a provider that the test manager considers does not meet Article 7(1) of the TLPT standards. Ask any provider to show how it meets those requirements before you sign.
Does a voluntary TIBER test count as our DORA threat-led test?
No. Under the TIBER-EU SSM guide, a significant institution may run a voluntary TIBER test through a national TIBER Cyber Team after informing the ECB, but that test is not a DORA TLPT and does not count toward the timing of your mandatory test. Voluntary testing can still be useful for learning and for building capability between mandatory cycles. Treat it as a separate project with its own scope, budget and reporting, and confirm the arrangement with the ECB before you start.
How is our Joint Supervisory Team involved in the test?
Your Joint Supervisory Team is a stakeholder in the test. It assesses the results and the remediation plan after the test ends. If the requirements are not met, the ECB may decline to issue an attestation. In that case the bank may still continue with the test for learning, but the test will not count as DORA TLPT. Keep the team informed through the single point of contact, who joins the control team when the test starts, so that supervisory expectations are clear before results are produced.
What must our bank provide before and during a TIBER-EU SSM test?
Most of the work is preparation. The bank must appoint a single point of contact who joins the control team when the test starts, set up the control team and its risk management, and agree the scope specification with the test manager. The scope covers the critical or important functions and the flags that the red team will target. The bank must also support procurement of external providers, agree contract terms such as confidentiality, forbidden actions, secure channels, liability and data destruction, and provide the access and information the test manager asks for. Confirm the full list of documents and deliverables in the ECB guidance for each stage.
How long does a TIBER-EU SSM test take?
The active red team phase lasts at least 12 weeks, and the closure phase has fixed deadlines. Replay, purple teaming and the blue and red team reports must be completed within 10 weeks of the end of active testing. The test summary report and remediation plan are due within 8 weeks of the authority's assessment. The preparation phase lasts up to six months from the authority's written notification. Procurement and scoping can change the total time, so ask the test manager to confirm the overall timeline in writing for your institution.
What drives the effort and cost of a mandatory test for our bank?
The main drivers are the size and complexity of the scope, the number of critical or important functions and flags, how mature your ICT environment is, and how many external providers you need to contract. Your internal effort depends on how well the control team is staffed and how much evidence and documentation is ready at the start. Costs fall into three groups: external threat intelligence, external red team testing, and internal time for the control team, blue team and remediation. Ask providers for a quote based on a written scope, and ask for the assumptions behind each line item.
How DeployOpen prepares systems and evidence for a TLPT
DeployOpen prepares the technical side of a TLPT for banks that have been identified as significant institutions. We do this as a fixed-scope engagement: we plan, implement, harden and document self-hosted open-source platforms, along with the logging, backup and evidence records that support them, inside the bank's own cloud accounts, data centers or air-gapped networks. Where the bank contracts it, we also run security testing or support a cyber range used to rehearse the test. Scope, deliverables and timelines are agreed in writing before any work starts, and the bank keeps ownership of its controls, its contracts and its relationship with the ECB, the Joint Supervisory Team and the control team. We do not act as the threat intelligence provider or the red team testers, and we are not a party to the procurement that the control team runs under the TIBER-EU SSM guide.
Before any engagement, we suggest the bank's control team and single point of contact confirm three things with us in writing: which systems fall within the flags and critical functions the test manager has approved, which logs and backups must be retained to answer the questions the red team and blue team reports will raise, and which records the bank will need to show the ECB's TCT-SSM and its Joint Supervisory Team during remediation. Each of these becomes a deliverable with an agreed format. Any timeline is set against the phases defined in the TIBER-EU framework, and the bank should check it against the dates set by the test manager, since those govern the test rather than our schedule.
Our deliverables prepare evidence. They do not establish that the bank has passed a test, and they do not replace the work of independent parties. Only the ECB issues the attestation for a TIBER-EU SSM test, and the test does not show a pass or fail result. Independent providers, not DeployOpen, produce the threat intelligence and red team outputs, and any assurance report the bank commissions must come from an independent assessor. We cannot guarantee any outcome of the test, the ECB's assessment or the bank's regulatory standing. Before signing, ask us to list each deliverable, the party that owns it and what the bank must still do itself.
