Who runs a TIBER-NL test and who pays for it in the Netherlands
If you are a Dutch financial institution, or an organization in another critical sector, facing a TIBER request or a DORA TLPT obligation, start with this split: DNB's Test Cyber Team oversees TIBER-NL tests, checks that process steps, deliverables and quality meet the framework, and issues the attestation, while your organization owns its controls and pays the external providers it procures. The Test Cyber Team is the authority's function, not a service you buy. Your costs sit with the threat intelligence provider, the red team testers and any internal effort for the control team and blue team, and those are the lines to scope with care.
Whether the test is voluntary or mandatory changes the picture. DNB says TIBER tests are voluntary for institutions such as large banks, payment institutions, pension providers and insurers, but a financial institution that meets DORA's criteria must perform TLPT, conducted according to TIBER-EU. A voluntary test is a decision you make with DNB, while a DORA-driven test is an obligation you must schedule and resource. Your organization's maturity also matters, since TIBER-EU is designed for entities that are sufficiently mature in ICT. If you are not there yet, DNB's Advanced Red Teaming framework may be the more suitable first step, and you should confirm its entry conditions with DNB directly.
Before you accept a quote, ask each provider to break its fee into preparation, testing and closure work, and to state which deliverables are included, such as the red team test plan, the red team test report and the blue team test report. Ask your internal leads to estimate their own hours for the control team and blue team, because that effort recurs across phases and is easy to underestimate. Confirm with DNB which documents and templates your procurement must follow, using the TIBER page on the DNB website as the starting point.
Voluntary TIBER-NL tests versus mandatory DORA TLPT
DNB describes TIBER tests as voluntary for institutions in the Dutch financial sector, including large banks, payment institutions, pension providers and insurers. An institution that chooses to take part works with the Test Cyber Team to run a controlled attack simulation against its live production environment, using a threat-led approach built on the TIBER-EU process. Participation is a decision for the board and senior management, not a supervisory order, and the test is designed to strengthen the institution's own detection and response capability.
- Outcome: DNB states that institutions cannot pass or fail a TIBER test. The report shows strengths and weaknesses so the institution can plan improvements.
- Deliverables: The process follows the TIBER-EU steps, including the test summary report, remediation plan and attestation issued by DNB.
- Sector fit: Pension providers, insurers and payment institutions can take part, so size alone does not decide eligibility.
- Resources: The institution pays for its own providers and staff time, and it should ask DNB which parts of its own team and budget the test will draw on.
- Gold teaming: DNB offers an optional crisis exercise on top of the test.
Before committing, confirm with DNB how your institution would be selected or invited and what preparation it expects.
A financial institution that meets the criteria in DORA must perform threat-led penetration testing (TLPT). DNB says that such an institution must carry out TLPT, and that the test is conducted according to TIBER-EU. This makes the test a regulatory duty rather than an invitation, and the timing and scope are set through the supervisory process, not chosen by the institution alone.
- Mandatory status: Whether your entity falls within DORA's TLPT criteria is a determination you should confirm with DNB and your supervisor.
- Method: The TIBER-NL implementation and guidance are the route the Netherlands uses to meet the DORA requirement.
- Cycle: The ECB cites the Netherlands as an example in which a DORA-subject entity completes TLPT every three years with the TIBER Cyber Team's support.
- Shared standard: The ECB states that the core requirements of DORA TLPT and TIBER-EU are identical, so a properly run TIBER-NL test is the mechanism for DORA compliance.
- Cost ownership: Budget for the test is the institution's responsibility, and the ECB and DNB materials do not set a fee in this context.
Ask DNB whether your planned test will be accepted as the DORA TLPT for the relevant cycle.
TIBER-NL is written for the financial sector, but organizations in other critical sectors can benefit from a structured approach. DNB has introduced the Advanced Red Teaming (ART) framework for institutions not yet ready for a TIBER or TLPT test, and notes that organizations in sectors such as healthcare, telecom and energy can also use it. A non-financial organization should not describe its work as a TIBER-NL test or a DORA TLPT, because neither obligation applies to it.
- Eligibility: TIBER-NL and DORA TLPT apply to the financial entities they name. Other sectors should confirm their own obligations under their own regulators.
- Alternative route: The ART framework is modular, which suits organizations that are not yet mature enough for a full TIBER test.
- Terminology: Label an ART engagement accurately in contracts and board reports so it is not mistaken for a regulated test.
- Provider choice: Non-financial buyers should confirm whether a provider's method, reporting and tester qualifications match their risk appetite.
- Expectations: Ask whether the outcome will be scored or certified, and whether any attestation is issued.
Confirm with DNB and your own sector regulator which framework, if any, applies to your organization before you scope the work.
How a TIBER-NL test moves through preparation, testing and closure
The sequence turns a written notification from DNB into a tested, documented and attested view of how an institution detects and responds to a realistic attack, with each phase producing the deliverables that the next phase depends on.
Receive notification and start initiation
The test begins when DNB, through its TIBER Cyber Team, notifies the institution in writing that it is taking part in a TIBER-NL test. The institution then holds an initiation discussion with the TIBER Cyber Team and test manager and agrees the roles of the parties involved. The step is complete when the initiation documentation is agreed and the institution has confirmed its participation in writing. Confirm with DNB which documents it expects at this point, since the templates it publishes govern the format.
Set up the control team and scope the test
The institution appoints a control team to manage the test internally and to keep it confidential from staff who are not involved. Together with the test manager, the team defines the scope, identifying the critical or important functions and the flags that the red team will try to reach. The output is the scope specification document, which the TIBER Cyber Team reviews against the framework before the test moves on. Confirm who inside the organization holds the control team role before this document is drafted.
Procure the threat intelligence and red team providers
The institution procures a threat intelligence provider and red team testers that meet the requirements for external providers under the framework. The procurement is the institution's responsibility, and the TIBER Cyber Team checks the providers it selects. The step closes when contracts are signed and the providers are confirmed as eligible. Ask DNB for its current guidance on service provider procurement before issuing any tender, and plan for the preparation phase to last up to six months from the written notification.
Produce the targeted threat intelligence report
The threat intelligence provider combines the generic threat landscape published by DNB with intelligence specific to the institution, then selects the attack scenarios that are most relevant to it. The result is the targeted threat intelligence report. The TIBER Cyber Team and the control team review the report, and the scenarios are fixed only after that review. Testing does not start until the report is accepted.
Agree the red team test plan and run active testing
The red team testers write a red team test plan that explains how they will pursue the chosen scenarios against the flags. The control team and test manager approve the plan before any active testing begins. Active red team testing then runs for at least 12 weeks, under the supervision of the control team and test manager, who manage the risk of disruption to live services. The step is complete when active testing ends and the red team has documented its actions.
Deliver red and blue team reports
After active testing, the red team issues its red team test report describing the attack paths it followed and the flags it reached. The blue team, which is the institution's defenders who were not told about the test, issues its blue team test report describing what it detected, how it responded and where it missed activity. Both reports go to the control team and test manager. The step is complete when both reports are accepted for the replay and purple teaming that follow.
Hold replay, purple teaming and 360 degree feedback
Within 10 weeks of the end of active testing, the red and blue teams walk through the attack step by step in a replay, then work together in purple teaming sessions to close the gaps. The institution also collects 360 degree feedback from the people involved. These sessions produce the purple teaming output and the feedback record, which feed directly into the test summary report. Check the 10-week window against the closure timeline in the framework when you plan the schedule.
Issue the summary, remediation plan and attestation
The TIBER Cyber Team reviews the quality of the whole test and the test summary report, which states strengths and weaknesses without a pass or fail result. The institution then writes its remediation plan, due within 8 weeks of the authority's assessment. DNB issues the attestation once it is satisfied that the framework's process steps, deliverables and quality have been met. The test is closed when the attestation is issued and the remediation plan is in progress.
Which DNB templates and documents the tested entity uses
DNB publishes a TIBER-EU implementation document for its Test Cyber Team and format templates for several test deliverables. The cards below cover the documents a tested entity is most likely to work with, when each applies in the test, and what to check before using a version. Always obtain current versions from DNB's TIBER page rather than relying on copies held elsewhere.
DNB TIBER-EU implementation document
This is DNB's national implementation document for its Test Cyber Team, describing how TIBER-EU is applied in the Netherlands. It sets out the roles, process steps and quality expectations that the tested entity and its providers will encounter across preparation, testing and closure. Read it before initiation so the control team understands which parts are mandatory TIBER-EU requirements and which are DNB-specific choices. Confirm the version date with DNB before you rely on it.
QA checklist template
The QA checklist is a DNB format template used to confirm that process steps, deliverables and quality meet the framework. The Test Cyber Team uses it to review the test as it progresses, so the tested entity should expect checks at each milestone rather than only at the end. Use it internally to track readiness for each deliverable and to identify gaps before the Test Cyber Team reviews them. Ask DNB which checklist version applies to your test.
Scope specification document
The scope specification document records which critical or important functions, systems and flags are included in the test, and the boundaries agreed with the authority. It is produced during preparation, when scoping is set and the threat intelligence provider and red team testers are procured. Check that every flag, live production system and third-party dependency is named, and that the agreed exclusions are written down. Changes made later tend to be costly to reconcile, so review the draft closely before sign-off.
Test summary report template
The test summary report template structures the final overview of the test for the authority and the tested entity. It is completed in closure, after the red and blue team reports, replay, purple teaming and 360 degree feedback, and it feeds the remediation plan. Make sure the summary references the underlying reports accurately, because the attestation depends on the record behind it. Plan the drafting effort early, since the closure timeline is strict.
Risks, actions and decisions log
The risks, actions and decisions log is a DNB template that records risks raised, actions agreed and decisions taken throughout the test. Unlike the closure documents, it is kept live across all three phases, so it shows how the control team handled issues as they arose. Assign an owner and a status to every entry, and record who approved each decision and when. Auditors and the authority will look at this log to understand why the test ran as it did.
What gold teaming and the Resilience Testing Community add
Beyond the test itself, DNB's Test Cyber Team offers two extras that a tested institution can use: a generic threat landscape that frames the test, and an optional crisis exercise called gold teaming. The generic threat landscape is prepared by the Test Cyber Team rather than by the institution's own threat intelligence provider, so it gives every participant a shared view of the threats relevant to the Dutch financial sector. It does not replace the targeted threat intelligence report that the provider produces for the individual entity. Gold teaming is optional. An institution that declines it still completes the TIBER-NL test in full, and no pass or fail result follows from taking part or declining.
Before deciding whether to join gold teaming, ask DNB which parts of the crisis exercise are run, who from your organization must attend (for example, executives who would make decisions in a real incident), how the exercise is scheduled relative to the red team test, what it costs and who pays for it, and how its findings are recorded and used in the remediation plan. Confirm also whether the exercise touches your live crisis procedures or runs in a separate environment, and who on your side would own any follow-up actions. Those answers determine whether the exercise adds value for your board and crisis management teams or only adds effort.
DNB's Resilience Testing Community is the channel for lessons learned across institutions that have completed TIBER tests. Participation is a practical way to learn which findings recur across the sector, how other entities have structured their control teams and purple teaming sessions, and which remediation approaches have held up. Ask DNB how the community is organized, whether participation is open to institutions that have not yet been tested, how shared information is anonymized, and what obligations apply to confidentiality. Treat the community as a source of comparison for your own remediation plan, not as a substitute for your own analysis of the test results. The official description of the programme is on the DNB TIBER page.
When the ART framework fits instead of a TIBER test
DNB introduced the Advanced Red Teaming (ART) framework in 2024 as a modular route for institutions not yet ready for a TIBER or TLPT test. The cards below set out the decision points that separate ART from a full TIBER-NL test, and what to confirm with DNB before committing.
Maturity of the testing programme
A full TIBER-NL test assumes an organisation can absorb a threat intelligence report, a live red team exercise and a structured blue team response. If your detection, response and reporting processes are still being built, a modular ART route can build those capabilities in steps. Ask DNB whether your current maturity meets the entry expectations for TIBER-NL before you assume ART is the lower option.
Sector and entity type
TIBER-NL is aimed at financial entities such as large banks, payment institutions, pension providers and insurers. ART is designed for institutions not yet ready for a TIBER or TLPT test, and organisations in other critical sectors such as healthcare, telecom and energy can also use it. Confirm with DNB whether your sector and entity type are in scope for ART, and whether your regulator expects a TIBER-based test instead.
DORA TLPT obligation
If you meet DORA's criteria for threat-led penetration testing, a modular route does not remove the obligation to perform TLPT, which is conducted according to TIBER-EU. ART can be a sensible preparatory step, but it is not a substitute for a DORA-compliant TLPT. Check your obligation with your supervisor before planning a modular programme.
Known readiness gaps
Start with a written inventory of gaps: incomplete asset inventories, untested incident response playbooks, weak third-party access controls or limited threat intelligence. Map each gap to the ART module that addresses it. A modular route fits when gaps are specific and can be closed in sequence. It is a poor fit when gaps span governance, architecture and staffing at once, and a broader readiness programme may come first.
Fit of a modular route
Ask whether the work can be split into modules with separate deliverables, owners and review points. A modular route suits teams that need to show progress to a board or supervisor between exercises. If your organisation needs one end-to-end exercise with a single attestation, a full TIBER-NL test may be more direct. Your provider can help estimate effort for each option, but the choice should follow your readiness gaps.
Confirm eligibility and modules with DNB
ART eligibility criteria, module content and reporting expectations are set by DNB and can change, so confirm them directly rather than relying on secondary summaries. Ask DNB which modules apply to your organisation, what outputs it expects, who must be involved on your side, and how results will be used in supervisory dialogue. Record the answers in writing before you scope any external work.
Who does what in TIBER-NL: the institution, DNB and external providers
The financial institution owns the test, its scope decisions and the remediation that follows. Under the TIBER-EU framework, the entity sets up a control team and a blue team, works through the preparation phase with DNB, and receives the test results. DNB does not run the defence on the institution's behalf, and the institution cannot hand accountability for the outcome to a provider.
- Governance and ownership: The board or senior management accepts the test, and a named control team leads day-to-day coordination with DNB and the providers.
- Scope and risk management: The institution identifies its critical or important functions and the flags that the red team will try to reach, and it manages the risks of live testing.
- Blue team operation: Its own security staff detect and respond during the test, and they produce the blue team test report.
- Remediation: The institution writes and delivers the remediation plan, and it funds and tracks the fixes.
- Procurement: The institution contracts its threat intelligence and red team providers, following the framework's requirements for those providers.
Before the test starts, confirm with DNB which control team roles and reporting formats apply to your institution and whether your DORA status changes the obligations.
DNB's Test Cyber Team runs the authority side of a TIBER-NL test. It oversees the test from start to finish, checks that process steps, deliverables and quality meet the framework, and provides the generic threat landscape. It is the party that issues the attestation, so its review is the point at which the test is formally closed.
- Generic threat landscape: The team supplies the sector-level threat picture that feeds the entity's targeted threat intelligence.
- Oversight and quality checks: It reviews deliverables against the framework and the DNB templates, including the QA checklist and scope specification document.
- Attestation: DNB issues the attestation that confirms the test was carried out in line with TIBER-EU.
- Optional gold teaming: The team can offer a crisis exercise that tests the institution's wider crisis management.
- Community learning: It runs the Resilience Testing Community, which shares lessons learned across participants.
Ask DNB which templates it expects you to use, such as the risks, actions and decisions log, and when each deliverable is due.
The institution procures the threat intelligence provider and the red team testers. These providers do the technical work: they build the targeted threat intelligence, plan the red team test, attack the flags and write the red and threat intelligence reports. The institution remains the contracting party and remains accountable for the work they produce.
- Threat intelligence provider: Produces the targeted threat intelligence report and selects the scenarios the red team will use.
- Red team testers: Write the red team test plan, carry out active testing and produce the red team test report.
- Commonly outsourced work: Threat intelligence research, adversary emulation, red team execution and report drafting are the usual areas of external support.
- Independence boundary: Providers may not issue the attestation or any report that DNB or an independent body must issue, and they should not present their work as a DNB outcome.
- Preparation support: Implementation partners may help prepare systems, logging and evidence for the test, but they do not take over the control team's decisions.
Ask each provider how it meets the framework's requirements for providers, how it handles the institution's data and live systems, and what it will deliver at each phase.
Common questions about TIBER-NL and DORA TLPT in the Netherlands
Is TIBER-NL mandatory for Dutch financial institutions?
No, TIBER-NL testing is voluntary for most institutions. De Nederlandsche Bank says TIBER tests are voluntary for institutions in the Dutch financial sector, such as large banks, payment institutions, pension providers and insurers. The exception is DORA. A financial entity that meets DORA's criteria for threat-led penetration testing (TLPT) must perform that test, and DNB says it is conducted according to TIBER-EU. Confirm with DNB which category your organization falls into, because the obligation depends on whether DORA's criteria apply to you.
Can an organization fail a TIBER-NL test?
No. TIBER-NL tests do not produce a pass or fail result. The purpose is to show where an institution is strong and where it is weak, so it can raise its cyber maturity. The output is a set of deliverables, including the red team and blue team test reports, the test summary report and a remediation plan. The Test Cyber Team issues an attestation once the process and quality requirements are met. Ask DNB how findings from the test will be treated in any supervisory dialogue before the test starts.
How does DORA TLPT relate to TIBER-NL?
DORA TLPT is the regulatory obligation, and TIBER-NL is the method used to meet it in the Netherlands. The ECB's September 2024 paper states that the core requirements of DORA TLPT and TIBER-EU are identical. The ECB cites the Netherlands as an example: a Dutch financial entity subject to DORA completes TLPT every three years with the support of DNB's TIBER Cyber Team, using the TIBER-NL implementation and guidance, which fulfils the DORA TLPT requirements. Your obligation is set by your supervisor, so confirm with DNB how a TIBER-NL test will be recognized as your DORA TLPT.
Can a non-financial organization use TIBER-NL?
Not as a TIBER-NL test for financial supervision, but the approach can be adapted. TIBER-NL is designed for the Dutch financial sector. DNB introduced the Advanced Red Teaming (ART) framework in 2024 as a modular approach for institutions not yet ready for a TIBER or TLPT test, and organizations in other critical sectors, such as healthcare, telecom and energy, can also use it. Ask DNB whether ART or any other route fits your sector and maturity before you describe your program as TIBER-based.
What does a TIBER-NL test need from our internal staff?
The test needs named people from several roles throughout the work. The framework involves five parties: the authority's Test Cyber Team and test manager, the control team and blue team at the tested entity, the threat intelligence provider and the red team testers. Your control team coordinates scope, oversees the red team under supervision and handles the closure phase, including replay and purple teaming. Your blue team defends during the live test without advance knowledge of the attack. Plan for these commitments with senior sponsorship, and confirm the exact staffing expectations with DNB.
How often do TIBER-NL tests run?
The framework treats an interval of three years between tests as the norm. Because tests consume significant resources and cost, the TIBER-EU framework sets three years as the usual cycle. The ECB's example of a Dutch financial entity under DORA describes TLPT every three years with DNB's support. Voluntary tests may follow a different schedule, so confirm with DNB when your next test is due and whether any earlier test would count toward your DORA obligation.
Can our organization run a TIBER-NL test without outside help?
No. The framework requires external providers for the threat intelligence and red team work, and the authority's role is oversight and attestation, not performing the attack. The organization owns its controls and its remediation, and the authority issues the attestation. An implementation partner such as DeployOpen can prepare systems, controls and evidence for the test and help with remediation, but it does not issue attestations or replace the Test Cyber Team. Ask DNB which providers are eligible and what the procurement and contract requirements are before you engage anyone.
How DeployOpen prepares systems and evidence ahead of a TIBER-NL test
DeployOpen works on the preparation side of TIBER-NL: De Nederlandsche Bank's TIBER programme, getting the systems, controls and records of an institution ready for a test that DNB's Test Cyber Team oversees. We do not run the test, issue the attestation or judge whether an institution meets DORA's threat-led penetration testing requirements.
How we scope
- Scope is agreed in writing before work starts, with systems, environments and deliverables named for the TIBER-NL engagement.
- We map the institution's in-scope production systems and supporting services against the scope specification document the institution agrees with its authority.
- Written scope states which evidence we prepare, which parts remain with the institution, and which items the Test Cyber Team or the independent providers own.
How we build
- We plan and implement self-hosted open-source platforms inside the institution's own cloud accounts, data centers or air-gapped networks.
- We configure logging, monitoring and access records so that the blue team and control team can reconstruct detection and response during the test.
- We harden and document the platforms, keeping configuration baselines and change records that the institution can present during the closure phase.
How we hand over
- Deliverables include system documentation, configuration records and evidence packs mapped to the agreed scope, delivered to the institution.
- We prepare working templates for the QA checklist, risks, actions and decisions log and remediation plan, using DNB's published formats where the institution has them.
- Handover includes a walkthrough with the institution's control team so staff can explain and maintain each platform after the engagement ends.
How we support
- Engagements are fixed-scope, and ongoing support, upgrades and continuous testing are available as a retainer.
- Ask for a written quote that lists the systems, the evidence packs, the templates and the handover sessions included in the scope.
- Confirm with your authority and the independent threat intelligence and red team providers which activities they reserve for themselves before we start.
