TIBER-FR test in France: process and who pays

How does a TIBER-FR test work in France, and what decides its cost and timing?

The Banque de France, ACPR and AMF run TIBER-FR together through the joint TCT-FR, and the National Implementation Guide applies whether your entity has received a designation letter from its TLPT authority or a voluntary invitation from TCT-FR. A TIBER-FR test is generally performed within a 3-year cycle, which the competent TLPT authority can shorten or extend. Your first task is to confirm which situation you are in, because the start date, the obligations and the level of scrutiny follow from it. Designated entities receive a notification of their mandatory TLPT start date from TCT-FR, while invited entities should ask TCT-FR in writing what the invitation commits them to. The tested entity owns the test. The guide says the TIBER Cyber Team accompanies the entity throughout, but the entity must supply the human and financial resources, coordinate multiple stakeholders over a few months, and plan carefully. Your own staff, your budget and your internal approvals set the pace more than any external party. DeployOpen can prepare systems, logging, asset inventories and evidence for the process, but it does not run the authority's process, sit on the control team as the authority's representative, or issue the attestation. Ask any provider to put its role in writing so that responsibilities for each phase are clear before procurement starts.

Three factors change the answer. The first is designation: a mandatory test follows the authority's timetable, while a voluntary test is shaped by what TCT-FR agrees with you. The second is vital importance: if an operator of vital importance has set flags on its vital information systems (SIIV), the guide requires providers listed by ANSSI as PASSI LPM certified and forbids subcontracting to firms that are not PASSI LPM certified and EU-based, so provider choice and the subcontracting chain carry most of the procurement risk. For SIIV tests you need not send the report to ANSSI, but you must be able to produce it on demand. The third is cross-border operation, because a test is recognised in all EU jurisdictions that implement TIBER-EU, which can remove the need for a second test elsewhere. Confirm each factor with TCT-FR at tiber-fr@banque-france.fr before you commit resources.

Who designates an entity for DORA TLPT, and who can be invited to a voluntary test

In France, the route into a TIBER-FR test depends on who designates the entity and whether it is required to test. The four paths below cover mandatory designation, the separate ECB track for significant institutions, voluntary invitations and cross-border recognition.

Designated by a national TLPT authority

The Banque de France, ACPR or AMF, acting as the TLPT authority for its supervised population, designates the entities that must perform a DORA threat-led penetration test. Designation is the trigger for a mandatory test under the TIBER-FR guide. Entities should confirm with their supervisor which authority holds their file, because the answer determines who issues the start notice and which supervisory contacts apply. Designation is not optional once issued. Keep the designation letter with the governance file for the ICT risk management framework.

Significant institutions under ECB supervision

For significant institutions, the ECB is the TLPT authority, and the TIBER-FR guide does not apply to their tests. A French bank in this group should follow the ECB route, which runs through the ECB's own cyber team and external testers rather than TCT-FR. Confirm the classification with the ECB or the Joint Supervisory Team before planning, since a test run under the wrong framework may not count toward the DORA requirement.

Voluntary invitation from TCT-FR

Entities that are not required to perform DORA TLPT can be invited by TCT-FR to run a voluntary TIBER-FR test, and the guide applies in full. The invitation is the entry point, not a self-selection. Ask TCT-FR what the invitation covers, which functions and flags it would test, and what resources the entity must commit. Voluntary tests do not replace a later designation, so confirm how the test would be treated if your status changes.

Start date notice from TCT-FR

After designation, TCT-FR notifies the entity of the start date of its mandatory TLPT. This notice sets the timeline for preparation, testing and closure, so it should be logged against the entity's compliance calendar on receipt. Check that the date allows enough time to procure a provider, since the guide describes TIBER-FR engagements as multi-stakeholder work over a few months. Direct any questions about the notice or your status to tiber-fr@banque-france.fr.

Cross-border recognition of the test

When an entity operates across borders, a TIBER-FR test is recognised in all EU jurisdictions that implement TIBER-EU. A group with subsidiaries in other adopting countries can often avoid repeating a test in each one, but this depends on how each authority applies its own rules. Confirm with TCT-FR which entities and functions the test covers, and ask the other authorities in writing whether they will accept the report before scoping.

The TIBER-FR phases from notification to remediation plan

The three TIBER-EU phases, applied through TCT-FR, turn a designation or voluntary invitation into a tested view of the entity's defenses, a remediation plan and an attestation. Each phase closes with a defined output that the next phase depends on.

Receive notification and start the preparation phase
The preparation phase begins with written notification from the competent authority, which for mandatory tests follows designation by the Banque de France, ACPR or AMF, and for voluntary tests follows an invitation from TCT-FR. TCT-FR then confirms the start date and the entity opens the initiation process with its authority. The step is complete when the start date is recorded and the entity has confirmed in writing that it will run the test under the TIBER-FR guide. The preparation phase is limited to six months from that written notification.
Set up the control team and risk management
The entity appoints a control team, which the 2025 framework renamed from the White Team, to oversee the test on its behalf. The team sets up risk management for the exercise, including how live activity is contained and who can stop it. The entity owns the test while TCT-FR accompanies it, so decision rights must be written down. The output is an approved control team roster and a risk management arrangement that TCT-FR has reviewed.
Scope critical or important functions and flags
The entity identifies its critical or important functions and the systems that support them, then sets the flags that the red team will try to reach. Where an operator of vital importance sets flags on its vital information systems (SIIV), the scope must reflect that status and the provider rules that apply to it. The scope specification document records the functions, flags and boundaries, and TCT-FR reviews it before the work moves on. Ask your authority which scope documents it expects for your entity.
Procure the threat intelligence provider and red team testers
The entity buys the services of a threat intelligence provider and red team testers, which the framework requires to be external to the entity. Procurement must follow the provider requirements in the TIBER-FR guide, and for SIIV tests the choice of provider is restricted to PASSI LPM certified firms that are EU-based. The output is signed contracts with both providers, with the test manager and control team named and the procurement file available to TCT-FR. Contract scope, liability and confidentiality terms should be settled before any testing begins.
Deliver the targeted threat intelligence report and red team test plan
The testing phase opens with the threat intelligence provider producing a targeted threat intelligence report. That report identifies the threat actors and scenarios most relevant to the entity, which the red team uses to build its test plan. The red team then writes its red team test plan, which the control team and TCT-FR review before any live activity. The step is complete when the plan is approved and the control team has confirmed the safeguards for live operations.
Run at least 12 weeks of active red team testing
The red team carries out active testing against the flags for at least 12 weeks, under the supervision of the control team and the test manager, with TCT-FR accompanying the exercise. The blue team, which is the entity's own defenders, does not know the timing or details of the attacks, so it responds as it would to a real intrusion. The control team monitors the work and can intervene to prevent harm. Active testing ends when the agreed scenarios are complete, and that end date starts the closure timeline.
Produce red and blue team reports and run replay and purple teaming
Within 10 weeks of the end of active testing, the red team issues its test report and the blue team issues its own. The entity then runs replay, which walks through the attack path with the defenders, followed by purple teaming, where both teams work together on detection and response gaps. The output is a shared view of what was attempted, what was detected and what was missed. Purple teaming is mandatory under the 2025 framework.
Complete 360 degree feedback and the test summary report
The closure phase gathers 360 degree feedback from the people involved in the test, so that the findings reflect both technical and organizational factors. The test summary report then pulls the findings together for the authority and records the test's strengths and weaknesses. TIBER-EU tests do not produce a pass or fail result. The summary report is the basis for the next step, and the authority's assessment of it sets the clock for the remediation plan.
Submit the remediation plan and obtain the attestation
Within 8 weeks of the authority's assessment, the entity submits a remediation plan that sets out how it will address the weaknesses found, with owners and an implementation approach. The authority reviews the plan, and once the closure requirements are met the test is concluded with an attestation. For SIIV tests, the entity does not send the test report to ANSSI but must provide it on demand. Keep the full evidence set, since the authority and any later test will rely on it.

Who is paid for what in a TIBER-FR engagement

This table shows who funds each cost component of a TIBER-FR test, whether it is one-time or recurring, and what moves it up or down. The TIBER-FR guide places the human and financial resources on the entity, so use the table to build your quote request and check that every role and phase is priced by someone.

Cost component	Who is paid	One-time or recurring	What drives it up or down
Red team testers	The tested entity pays the external provider it procures; the TIBER Cyber Team does not fund them	One-time per test cycle	Number of flags, size and complexity of the scope, and length of active testing
Threat intelligence provider	The tested entity pays the provider it procures for the targeted threat intelligence report	One-time per test cycle	Breadth of the threat landscape assessed, number of scenarios selected, and whether the provider is also the red team
Implementation or preparation partner	The tested entity pays any partner it engages to help prepare systems, documents and evidence	One-time, with possible follow-on support	How much preparation the entity already has, readiness of its control team, and the number of documents it must produce
Internal staff time for the control team and blue team	Internal payroll, not an invoice; the entity pays for staff it assigns	One-time per test, spread over a few months	Number of stakeholders involved, how many blue team members respond, and how much coordination the test requires
Tooling and evidence collection	The entity pays for any licences or tools it adds, and may bear infrastructure costs	Mostly one-time, some recurring if tools stay in use	Whether existing monitoring and logging can serve as evidence, and how much new tooling is needed
Remediation after the test	The entity pays internal teams and any contractors it hires to fix weaknesses	One-time for the fixes, ongoing for the maturity program	Number and severity of weaknesses found, and how many can be fixed with existing resources
Project management and planning	The entity pays internal project managers or any consultant it engages for planning	One-time per test	Number of parties in the five-party test structure and how early planning starts

What makes a TIBER-FR test more expensive or longer

A TIBER-FR test is paid for in people and time, and the same few decisions drive most of both. The six drivers below are the ones that move effort up or down, and each one can be shaped during early scoping, a written scope specification and a settled stakeholder list. Ask every provider and internal team to price against the same written scope so differences in quotes reflect the work, not guesses about it.

Number and criticality of flags

Flags mark the critical or important functions and the systems that support them, and each flag widens the threat intelligence work, the red team plan and the number of findings to remediate. A long list of flags with equal weight usually costs more than a shorter list of well-chosen flags tied to real business impact. Before scoping closes, confirm with the TIBER Cyber Team which functions are in, why each is critical, and which ones can be tested in a later cycle. Every added flag adds effort across all phases.

Locations and third parties in scope

Each data center, office, cloud region or outsourced service that a flagged function touches adds access paths, approvals and coordination for the red team. Third parties may need their own consent, contract clauses or testing limits before the red team can act against their systems. Ask the entity to map every location and provider the flags depend on during scoping, and record in the scope specification which ones are out of bounds.

Maturity of internal evidence

Red team and blue team reports are easier to produce, and the closure phase moves faster, when asset inventories, architecture diagrams, network maps and past incident records already exist and are current. When these documents are missing or out of date, the threat intelligence provider and red team spend early weeks rebuilding context. Ask the entity to check the state of its documentation before procurement, and to note gaps in the scope specification so they are funded as work, not discovered mid-test.

Stakeholders in control and blue teams

The control team, which the 2025 framework renamed from the White Team, and the blue team need named people for decisions, approvals, monitoring and reporting. Each additional department, outsourced security operations provider or approver lengthens meetings, handoffs and sign-off cycles. Settle the stakeholder list in writing before testing starts, with a named owner for each role and a deputy, so that the test does not stall while people are found.

Operator of vital importance with SIIV

When an operator of vital importance sets flags on its vital information systems, TIBER-FR requires providers listed by ANSSI as PASSI LPM certified and bars subcontracting to firms that are not PASSI LPM certified and EU-based. A smaller pool of qualifying providers can mean longer procurement and higher rates. Confirm early whether any flag falls under SIIV, and ask providers to show their PASSI LPM status and any subcontractors before the contract is signed.

Cross-border recognition needs

The guide states that a TIBER-FR test is recognized in all EU jurisdictions that implement TIBER-EU when the entity operates across borders. If the entity needs that recognition, the scope, reporting and attestation must satisfy more than one authority, which adds review and alignment work. Ask the TIBER Cyber Team early which authorities will rely on the test, so the test summary report and remediation plan are written to cover them from the start.

What the 2025 guide adds for operators of vital importance and PASSI providers

An operator of vital importance that sets flags on its vital information systems (SIIV) takes on provider rules that do not apply to other TIBER-FR tests. The TIBER-FR guide requires that the red team testers come from providers listed by ANSSI as PASSI LPM certified. It also forbids subcontracting to any firm that is not both PASSI LPM certified and EU-based. For entities outside this category, the guide only recommends PASSI-RGS certified, EU-based providers. Before the procurement phase starts, the entity should decide whether its flags fall within SIIV, because that decision determines which providers are eligible and how the tender is written. Since the ECB's TIBER-EU procurement guidance covers service provider selection in general, the SIIV requirement is the French addition the reader must layer on top of it.

The reporting rule for SIIV tests is lighter than the provider rule but still needs planning. The entity does not have to send the test report to ANSSI, yet it must be able to produce that report to ANSSI on demand. In practice, the closure phase should leave a retrievable, complete copy of the red team and blue team reports, the test summary report and the attestation in the entity's own records, with named owners and a retention approach agreed with TCT-FR. The entity should also confirm with TCT-FR how the SIIV status of its flags is recorded in the scope documentation, so the reporting obligation is traceable from the start.

Confirm each provider's PASSI LPM status directly with ANSSI before signing, and write that status into the contract as a warranty with a notice obligation if it lapses during the engagement. This page does not verify any provider's certification, and certification lists can change. Ask every bidder to name any subcontractor, confirm that subcontractor's PASSI LPM status and EU establishment, and record the check in the procurement file. Ask TCT-FR at tiber-fr@banque-france.fr to confirm how it treats a provider whose certification status changes during an active test.

Which provider and test route fit the entity's situation

This table compares the four situations a French entity can be in, with the provider requirement that applies to each and what to verify before signing. Read each row against the entity's designation status and whether it has set flags on vital information systems (SIIV). The main takeaway is that SIIV flags, not the test type alone, decide which provider certification applies.

Situation	Provider requirement	What to verify
SIIV flags set on vital information systems	Providers must be listed by ANSSI as PASSI LPM certified. Subcontracting to firms that are not PASSI LPM certified and EU-based is forbidden.	Confirm the provider's PASSI LPM listing with ANSSI, and check every subcontractor in the chain against the same requirement.
No SIIV flags set	PASSI-RGS certified, EU-based providers are recommended by the TIBER-FR guide, not required.	Confirm the PASSI-RGS status and EU establishment, and record the reasons if a non-certified provider is chosen.
Designated for mandatory DORA TLPT	The TLPT authority designates the entity and TCT-FR notifies the start date. The same provider rules apply according to SIIV status.	Confirm the start date in TCT-FR's notice, the 3-year cycle the authority has set, and whether the test counts as DORA TLPT.
Voluntary TIBER-FR invitation	TCT-FR invites the entity to run a test. The TIBER-FR guide applies in full, so the same provider rules apply according to SIIV status.	Confirm with TCT-FR what the invitation covers, the expected resources, and that the entity has the internal capacity to run the engagement.

Who does what: the entity, TCT-FR and the providers

The tested entity owns the test from start to finish. Its management sets the scope within the guide, its control team coordinates the exercise internally, and its blue team detects and responds to the red team. The entity also supplies the human and financial resources the guide requires, because a TIBER-FR engagement involves many stakeholders over a few months and needs thorough planning. Responsibility for remediation and for the attestation that closes the test stays with the entity.

Test ownership: the entity remains accountable for how the test is run and for what it does with the results.
Control team: the internal group that manages the test day to day, protects confidentiality and keeps the flags and scope under control.
Blue team: the staff who detect and respond to the red team, whose report feeds the closure phase.
Resources: named people from security, IT and business functions, plus a budget for providers, committed before procurement starts.
Remediation and attestation: the entity prepares the remediation plan after the authority's assessment and signs the attestation that closes the test.

Confirm who will lead the control team and secure written staffing and budget commitments before the preparation phase begins.

What usually delays a TIBER-FR project and how to avoid it

Most slow TIBER-FR engagements trace back to a handful of decisions made early: when procurement starts, who inside the entity is committed, how roles are split, what the systems in scope look like on paper, and which providers are eligible. The cards below set out one prevention step for each, so the entity can settle these points before the clock on the mandatory phases gets tight.

Starting procurement before scope is agreed

Providers price their work from the scope, so buying red team and threat intelligence services before the scope specification is settled leads to re-quotes, contract amendments and lost weeks. Under TIBER-FR the entity owns the test and the TIBER Cyber Team accompanies it, so the scope and the flags must be approved first. Prevention step: agree the scope specification document with TCT-FR, then issue the procurement request against that written scope only.

Underestimating the internal resources

The guide states that TIBER-FR engagements require human and financial resources supplied by the entity. Teams often plan for the red team and forget the people who must answer questions, approve decisions, review reports and run remediation over several months. Prevention step: before notification, name a project lead and the staff hours each stakeholder group will give, and have management sign off on that allocation.

Unclear roles across control and blue teams

The control team manages the test on the entity side, while the blue team defends against the red team without knowing the test is under way. When these roles overlap, the control team either leaks scenario details to the blue team or cannot make timely decisions about live activity. Prevention step: write a one-page roles matrix that names each person, their team, what they may know and who can stop the test, and confirm it with TCT-FR at initiation.

Weak evidence of systems in scope

Flags are set on critical or important functions, and the systems behind them must be identified precisely. Asset inventories that are outdated, missing third-party components or unclear on ownership cause scope disputes and rework during the scoping phase. Prevention step: reconcile the configuration management database against network and cloud records for each flagged function, and record the owner, location and data flow of every system before the scope document is drafted.

Selecting a provider without checking PASSI status

Where an operator of vital importance sets flags on its SIIV, the guide requires providers listed by ANSSI as PASSI LPM certified and forbids subcontracting to firms that lack that certification or are not EU-based. A provider that looks qualified may therefore be ineligible, and the error surfaces only after contracting. Prevention step: check the current ANSSI PASSI listing for every prime contractor and subcontractor before shortlisting, and ask each provider to confirm its status in writing.

Common questions about TIBER-FR and DORA TLPT in France

Who designates our organization for a DORA TLPT in France?

Your TLPT authority designates you, and that authority is the Banque de France, the ACPR or the AMF, depending on which of them supervises your entity. The ECB is the TLPT authority for significant institutions, and the TIBER-FR guide does not apply to those entities. After designation, TCT-FR, the joint TIBER Cyber Team that the three French authorities set up, notifies you of the start date of your mandatory TLPT. If you have not been designated but believe you fall within DORA TLPT scope, ask your supervisor which authority holds your file before you plan staffing or budget. The notified start date is the anchor for every other planning decision.

Can we run a TIBER-FR test voluntarily if we are not designated?

Yes, if TCT-FR invites you. Entities that are not required to perform DORA TLPT can be invited to run a voluntary TIBER-FR test, and the TIBER-FR guide applies in both cases. A voluntary test follows the same framework steps, so the effort, roles and deliverables are comparable to a mandatory test. Do not assume you can start one on your own initiative. The invitation comes from the authority side, so the first step is a conversation with TCT-FR at tiber-fr@banque-france.fr. Ask what the invitation involves, what the authority expects from your board and what the results will and will not be used for before you commit internal resources.

How long does a TIBER-FR test take from start to finish?

The framework sets phase timings that the TIBER-FR guide follows: preparation lasts up to six months from the authority's written notification, the testing phase includes at least 12 weeks of active red team testing, and closure runs replay and purple teaming within 10 weeks of the end of active testing. The remediation plan is due within 8 weeks of the authority's assessment. Those phases add up to a multi-month engagement with many stakeholders. Confirm the exact dates for your test with TCT-FR, because the timeline depends on your notification date, procurement of providers and the authority's review periods.

What does a TIBER-FR test cost in effort, and who pays for it?

The tested entity pays for the test. The TIBER-FR guide states that engagements require human and financial resources supplied by the entity. Cost falls into three groups: external providers (the threat intelligence provider and the red team testers), internal staff time for the control team and blue team, and the coordination effort of planning and reporting across several months. Scope size, the number of flags on critical functions, the depth of purple teaming and the quality of your existing logging and detection drive these costs up or down. The guide does not publish a fee schedule, so ask providers and your own finance team for a written breakdown of one-time and recurring items.

Can we run a TIBER-FR test in-house, or must we use outside testers?

The framework requires separate parties for the threat intelligence and red team roles, so plan on external providers for those functions and confirm the details with TCT-FR. The TIBER-EU model involves five parties: the TIBER Cyber Team and test manager at the authority, the control team and blue team at the tested entity, the threat intelligence provider and the red team testers. Your own staff fill the control team and blue team roles. For SIIV operators, provider eligibility is tightly defined, as covered below. DeployOpen runs security testing, including red teaming, but it does not issue audit reports or attestations, and the provider choice is yours to make against the authority's rules.

What does the 3-year cycle mean for our organization?

It means a TIBER-FR test is generally performed once every three years. The competent TLPT authority can shorten or extend that cycle for your entity, so the interval is a default rather than a fixed promise. Treat the three years as the baseline for budgeting, then ask the authority whether it has changed your interval. If you operate across borders, a TIBER-FR test is recognized in all EU jurisdictions that implement TIBER-EU, which can reduce duplicate testing for group entities in those countries. Confirm the recognition details for your specific group structure with TCT-FR before you plan multi-country coverage.

What changes if we are an operator of vital importance with SIIV systems?

If you set flags on your vital information systems (SIIV), the TIBER-FR guide requires providers listed by ANSSI as PASSI LPM certified. It also forbids subcontracting to firms that are not both PASSI LPM certified and EU-based. Outside SIIV tests, PASSI-RGS certified, EU-based providers are recommended but not required. For SIIV tests, you do not need to send the test report to ANSSI, but you must be able to provide it on demand. Check the current ANSSI listings before you shortlist providers, and make certification status and subcontracting terms explicit in every provider contract.

Who should we contact about the status of our TIBER-FR test?

Send status questions to tiber-fr@banque-france.fr. That address serves the joint TCT-FR team, which sets up the test and notifies entities of their mandatory start dates. Prepare your questions before you write: your designating authority, your notification date, the flags you propose and any open procurement steps. Keep a written record of each reply, because the authority's answers will set the dates your provider contracts and internal staffing must match. The TIBER-FR National Implementation Guide is the first document to read for process questions.

How DeployOpen prepares systems and evidence for a TIBER-FR test

DeployOpen works on TIBER-FR as the team that prepares the systems, controls and evidence an entity needs before and during a test. We plan, implement and document self-hosted open-source platforms inside your own infrastructure. Reports and attestations come from the parties the framework names, and the entity keeps ownership of the test.

How we scope

Written scope agreed before work starts, covering the systems, flags and evidence the TIBER-FR test will examine.
Scope confirms which critical functions and flags sit inside the engagement, with the entity's sign-off on each item.
Engagements are fixed-scope, with deliverables and timelines in writing; ongoing support is available as a retainer.

How we build

Self-hosted open-source platforms deployed in your cloud, data center or air-gapped network, configured to your control inventory.
Logging, asset inventories and access records configured so the control team can trace each flag's protection and monitoring.
Hardening and backup procedures documented against the blue team's detection and recovery processes before testing starts.

How we hand over

Written documentation of configurations, data flows, owners and change history for the control team and blue team.
Evidence packs indexed to the TIBER-FR deliverables so the entity can provide the material to the TCT-FR on request.
Clear split of roles: DeployOpen prepares systems and evidence; reports and attestations come from the framework's named parties.

How we support

Ongoing support available as a retainer for changes, upgrades and continuous testing between test cycles.
If SIIV flags apply, confirm with TCT-FR which PASSI LPM certified providers are required before scope is agreed.
Ask DeployOpen to confirm in writing which parts of the scope fall within its own roles before you sign.