What TIBER-SE requires and what it costs in Sweden
If Finansinspektionen has ordered your entity to run threat-led penetration testing, TIBER-SE is the Swedish implementation of TIBER-EU and the method you will use to meet DORA TLPT in Sweden. Separately, Riksbank regulation RBFS 2025:2, in force from 1 January 2026, charges entities in that position an annual fee to cover the Riksbank's costs of overseeing and coordinating the tests and issuing attestations. The fee is split 70% evenly between obliged entities and 30% by balance sheet total. Treat it as an administrative charge owed to the Riksbank, not as part of the red team engagement.
The fee and the test cost are two different budget lines, and they move for different reasons. The Riksbank's fee depends on how many entities are obliged in a given year and on your balance sheet total, and the Riksbank decides each year's fee by 30 November of the following year. If your obligation starts partway through a year, the fee is prorated, and late payment can carry interest. The cost of the test itself depends on your scope, the number of critical or important functions and flags in play, the threat intelligence and red team providers you procure, and how much control team and blue team effort your organization must supply.
Before committing budget, confirm with Finansinspektionen the date your obligation applies and the testing frequency it sets, since the default cycle is at least every 3 years and the authority can ask for more or less often based on risk. Ask the Riksbank which fee year applies to you and how proration will be calculated. When requesting provider quotes, ask for the cost of each TIBER-SE phase separately, what is one-time and what recurs, and how replay, purple teaming and remediation support are priced. Work from your own scope document rather than a generic estimate.
Who pays what in the Riksbank fee and the test
This table separates the Riksbank's annual fee under RBFS 2025:2 from the costs of running a TIBER-SE test, which are paid to other parties. Read the fee as a recurring oversight charge and the test costs as project spending that a fixed-scope quote must cover, then check the drivers in each row before comparing offers.
| Cost component | Who is paid or who pays | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Riksbank annual fee | Paid by entities Finansinspektionen has ordered to perform TLPT, to the Riksbank | Recurring, set each year by 30 November of the following year | 70% split evenly across obliged entities, 30% by balance sheet total; part-year obligations are prorated; late payment can carry interest |
| Threat intelligence provider | Paid by the tested entity under its procurement contract | One-time per test cycle | Scope of the targeted threat intelligence report and number of scenarios; ask whether the quote includes the report and its updates |
| Red team testers | Paid by the tested entity under its procurement contract | One-time per test cycle, spanning the active testing period | Length of active red team testing (at least 12 weeks under TIBER-EU), number of flags and in-scope functions, and the scope specification |
| Entity control team and blue team | Internal staff time or costs paid to contractors | One-time per test cycle, plus preparation and closure work | Headcount released from other duties, reporting volume, and whether the entity needs external support for replay and purple teaming |
| Implementation partner (if used) | Paid by the entity for preparation, evidence and coordination support, under a written scope | One-time per engagement; ongoing support is a separate retainer | Amount of readiness work, system access needed, and whether the partner also supports later remediation |
| Remediation work | Internal teams or vendors chosen by the entity | One-time per finding, often after the remediation plan is due | Number and severity of weaknesses found, and the state of the entity's own ICT systems |
| Voluntary or additional tests | Not covered by the Riksbank fee; entity pays all test costs | Entity decides frequency | Whether the entity tests outside a Finansinspektionen order; confirm with the Riksbank how such tests count |
How a TIBER-SE test runs from notification to attestation
This sequence takes a TIBER-SE test from the authority's written notification through preparation, testing and closure to attestation. Each step produces an output that the next step depends on, so gaps in scoping or provider procurement show up early.
Receive written notification and start preparation
The authority's written notification opens the preparation phase, which lasts up to six months. The entity names its internal contacts, confirms receipt, and begins arranging the people, governance and risk management the test will need. The output is a confirmed start point and named internal owners, recorded in writing. Confirm with the Riksbank which notification route and contacts apply to your entity under the current TIBER-SE document.
Initiate the test and form the control team
Initiation sets out the purpose, governance and roles of the test. The entity forms its control team, the group that knows the test is running and supervises it on the entity's side, and agrees how risk management will handle live attacks that threaten production services. The output is an agreed initiation document and a control team with named members. Ask the Riksbank whether it expects to review the initiation document and which template applies.
Scope critical or important functions and flags
The entity identifies the critical or important functions in scope and the flags, which are the specific objectives the red team will try to reach. Scoping also decides which supporting systems and third-party ICT services can be touched and sets the limits the red team must respect. The output is a scope specification document accepted by the control team, the test manager and the authority. Confirm in the current TIBER-SE document how third-party services are handled during scoping.
Procure threat intelligence and red team providers
The entity procures a threat intelligence provider and red team testers, following the TIBER-EU guidance on service provider procurement. The procurement checks each provider's skills, independence and handling of sensitive test data, and the control team reviews the candidates. The output is signed contracts with both providers. Confirm with the Riksbank and Finansinspektionen any Swedish requirements on provider eligibility, contract terms and whether testers may be internal.
Deliver threat intelligence and the red team test plan
The threat intelligence provider prepares a targeted threat intelligence report that identifies the threat actors and scenarios most relevant to the entity. The red team turns the selected scenarios into a red team test plan, and the control team and test manager review both against the flags and risk limits. The output is an approved red team test plan, which sets the boundaries for the active testing that follows.
Run at least 12 weeks of active red team testing
The red team tests the flags for at least 12 weeks under the supervision of the control team and test manager, following the approved plan. The blue team usually works without advance knowledge of the attack paths, so its detection and response reflect normal operations. The output is a log of attack activity, detections and escalations kept by the control team, which feeds the reports in the closure phase.
Issue test reports and run replay and purple teaming
The red team and blue team each produce their test reports. The control team then runs a replay with the blue team, walking through the attack step by step to see what was detected and what was missed. Purple teaming follows, where red and blue work together to test and improve specific defenses. Replay and purple teaming take place within 10 weeks of the end of active testing. The output is the red team and blue team test reports and a record of the replay and purple teaming outcomes.
Close the test with attestation
The 360 degree feedback gathers views from the people involved across the test, and the test summary report brings the findings together. The entity then delivers its remediation plan within 8 weeks of the authority's assessment. The Riksbank issues the attestation under its own process, so confirm the Swedish attestation steps against the current TIBER-SE document. The output is the test summary report, the remediation plan and the attestation, which record strengths and weaknesses, not a pass or fail result.
What the 2026 framework update changes for Swedish entities
The main point for Swedish entities is that the framework they test under is changing, and the Riksbank said in April 2026 that TIBER-SE was being updated. The change follows the Eurosystem's 2025 revision of TIBER-EU, which aligned the process steps with the deliverables and strict timelines of the DORA TLPT standards. Three changes matter most in practice: purple teaming is now mandatory, the White Team has been renamed the Control Team, and the closure phase is tied more tightly to the DORA deliverables. A test planned under the older wording needs its scope, roles and reporting checked against the current text before work starts.
Do not assume the final content of the Swedish update. The Riksbank's TIBER-SE page describes the framework and is the first place to look for any Swedish-specific adjustments, such as how the Riksbank expects the Control Team to be staffed, how it handles attestations, or how it links the test to the fee regime under RBFS 2025:2. Ask the Riksbank or the Finansinspektionen, in writing, which version applies to a test you are planning and whether any element is still in draft. Record the answer in the initiation documents so the scope and timeline rest on a confirmed text.
Entities should plan for the update in three concrete ways. First, map existing internal roles to the Control Team and confirm who can approve live-testing decisions and who sits in the blue team. Second, build purple teaming into the closure plan from the start, because it is no longer optional and it needs blue team time and a facilitator. Third, review contracts with threat intelligence and red team providers so that they reference the current TIBER-EU guidance documents and the deliverables the update requires. If the update changes any of these points before your test begins, your provider and your authority contact should confirm the impact in writing.
What to have in place before the notification arrives
A TIBER-SE test starts with a written notification from the authority, and the preparation phase is short relative to the work it demands. The items below are what a financial entity should be able to show before that notice arrives, with a named owner for each. Most gaps are discovered in procurement or scoping, so checking them early is cheaper than fixing them later.
Named control team and risk management
Appoint a control team that supervises the red team and can stop or adjust live testing without waiting for escalation. Put in writing who holds the mandate, who deputizes, and how the team handles risk to production systems and to people. Check that the named individuals have the authority to approve scope changes and that the risk management arrangement is documented before the testing phase begins. The board or executive owner signs off; the CISO or head of security chairs the team.
Inventory of critical functions and ICT systems
Maintain a current list of the critical or important functions the entity provides and the ICT systems, data flows and third parties that support each one. This inventory becomes the basis for scoping and for the flags the red team tries to reach. Check that it is reconciled against the configuration management database and that business owners have confirmed it. The head of operational risk or the business continuity lead usually owns the function list, while IT owns the systems list.
Record of prior testing and remediation
Collect the penetration tests, vulnerability assessments and audit findings from the past several years, together with evidence of how each finding was closed. Assessors and the control team will use this record to judge whether the entity already knows its weaknesses and whether fixes stick. Check for open high-severity items and for findings that were accepted as risk without a documented decision. The security assurance team owns the register.
Budget and fee forecast for the obligation year
Under RBFS 2025:2, entities that Finansinspektionen has ordered to perform TLPT pay an annual Riksbank fee from 1 January 2026, with 70% split evenly between entities and 30% by balance sheet total. The Riksbank decides each year's fee by 30 November of the following year, prorates it for partial-year obligations, and may charge late-payment interest. Ask finance to model the fee alongside the internal and external test costs, and confirm the obligation year with the authority. The CFO and head of compliance share ownership.
Procurement path for external providers
TIBER-SE tests rely on external threat intelligence providers and red team testers, procured under the TIBER-EU service provider guidance. Define the procurement route, the evaluation criteria and the contract terms before the notification, including data handling, liability and how the provider's staff are vetted. Confirm with the authority whether any provider qualifications apply in Sweden. The procurement lead owns the process, with legal reviewing the contract template.
Internal knowledge of DORA ICT risk management
The control team should understand how TLPT fits into the entity's DORA ICT risk management framework, including how test findings feed back into ICT risk assessment, incident response and third-party oversight. Check that staff can explain the difference between what DORA TLPT requires, which describes what to do, and TIBER-SE, which describes how. Training gaps are easiest to close before the test, and the framework update in progress in 2026 is a reason to confirm which version applies. The head of ICT risk owns this readiness item.
Who does what: the Riksbank, the entity, providers and the implementation partner
The Riksbank runs the TIBER-SE framework in Sweden and is the body that oversees and coordinates tests carried out under it. Under RBFS 2025:2, which applies from 1 January 2026, the Riksbank charges an annual fee to entities that Finansinspektionen has ordered to perform threat-led penetration testing. That fee covers the Riksbank's costs of overseeing and coordinating the tests and of issuing attestations, so the entity pays for the authority's work on its test, not for the test itself.
- The annual fee: 70% is split evenly between obliged entities and 30% follows balance sheet total, as set out in the regulation.
- Yearly decision: the Riksbank decides each year's fee by 30 November of the following year.
- Proration: entities obliged to test for only part of a year pay a prorated amount.
- Late payment: the regulation allows the Riksbank to charge late-payment interest.
- Attestation: the Riksbank issues the attestation that a test has been completed in line with the framework.
Before budgeting, ask the Riksbank or your finance team to confirm how the fee applies to your balance sheet and any partial year.
Finansinspektionen, the Swedish financial supervisor, decides which financial entities must perform threat-led penetration tests. That decision is the trigger for the mandatory obligation under DORA. An entity that has not received such a decision is not obliged to test under RBFS 2025:2, although it may still choose a voluntary test under TIBER-SE.
- Designation: Finansinspektionen identifies the entities that must carry out TLPT.
- Frequency: financial entities identified by their competent authority must test at least every 3 years, and the authority may ask for more or less frequent testing based on the entity's risk profile.
- Scope of obligation: RBFS 2025:2 applies to the entities Finansinspektionen has decided must test.
- Legal basis: the Swedish act supplementing DORA (2024:1278) underpins the regulation.
- Questions to put to the supervisor: whether the decision names a test date, what the risk profile considered, and what the authority expects in the test report.
If you have not received a decision, confirm your status directly with Finansinspektionen before assuming either way.
The tested entity owns its controls, its risk decisions and its remediation. It runs the control team that supervises the test on its side and the blue team that detects and responds to the red team's activity. The board and senior management remain accountable for the outcome, whichever external firms are engaged. Under TIBER-SE the test shows strengths and weaknesses; it does not produce a pass or fail result, so the entity decides what to fix and how fast.
- Control team: the internal group that manages the test day to day, including risk management and secrecy of the test.
- Blue team: the defenders whose detection and response are measured during the test and who write the blue team test report.
- Scope decisions: the entity agrees with the authority which critical or important functions and flags are tested.
- Remediation: the entity produces a remediation plan and carries it out, with progress tracked against the framework's deadlines.
- Procurement: the entity contracts the threat intelligence provider and red team testers in line with the framework's procurement guidance.
Confirm internally who holds each of these roles before the notification arrives, because the framework's timelines start from it.
The threat intelligence provider and the red team testers are external to the entity and carry out the offensive work. The threat intelligence provider produces the targeted threat intelligence that shapes the scenarios. The red team testers then attempt to reach the flags over the active testing period. Their reports feed the closure phase, and their independence from the entity's own operations is a core expectation of the framework.
- Threat intelligence provider: delivers the targeted threat intelligence report that the red team uses to select scenarios.
- Red team testers: prepare the red team test plan, run active testing and write the red team test report.
- Procurement: the entity selects these providers, and the framework's guidance covers service provider procurement.
- Contracts: agreements should set out rules of engagement, confidentiality, data handling and the deliverables required by the framework.
- Questions to ask providers: their TIBER experience, how they staff the test, and how they handle findings that affect live systems.
Check with the Riksbank whether any provider or testing arrangement needs its approval before you sign.
An implementation partner such as DeployOpen can help an entity prepare for a TIBER-SE test and carry out the remediation work that follows. The partner prepares systems, controls and evidence so the entity can show how its environment works and how its controls are operated. It does not decide scope, select providers on the entity's behalf, issue the attestation, or certify that a test was passed. Only the authorities and the independent parties they recognize can issue those outcomes.
- Readiness support: reviewing systems, logging, access and evidence so the control and blue teams can demonstrate their processes.
- Remediation support: building or hardening the fixes in the remediation plan, with documentation for each change.
- Scope and fixed deliverables: work is agreed in writing before it starts, with scope and timelines defined in advance.
- Independence boundary: the partner does not write the attestation, the test summary report or any statement that the entity meets DORA TLPT.
- Confirm before engaging: whether the partner's work is treated as a contribution to the entity's own controls, and whether the Riksbank expects any separation between preparation and red team testing.
Ask any partner to state in writing which deliverables it prepares and which the entity, the providers and the Riksbank own.
How to choose a red team or readiness partner for a Swedish TLPT
A TIBER-SE test under DORA TLPT depends on the provider as much as on the framework. The checks below help you test whether a red team or readiness partner can work inside the TIBER-EU requirements that the Riksbank applies in Sweden. The organization keeps ownership of its controls and evidence, and only an independent assessor or certification body issues reports or attestations.
Confirm external tester eligibility
Ask the provider to show, in writing, how its red team testers meet the external tester requirements of TIBER-EU and the TIBER-SE implementation. Confirm the tester requirements with the Riksbank and Finansinspektionen before you shortlist, since the framework update in progress may change how this is documented. Ask for the named testers' qualifications and the process used to verify them, so the file is ready if the authority reviews it.
Verify independence from the entity
Ask the provider to declare every existing relationship with your organization and with your ICT providers, including managed services, cloud platforms, outsourced security operations and any prior advisory work on the systems in scope. A provider that operates or configures the systems it will test has a conflict that the authority is likely to question. Ask how the provider will separate the team that performs the red team work from any team that has supported the tested systems.
Ask for financial sector experience
Ask for examples of threat-led testing in regulated financial entities, described in anonymized form, and for the scenarios and attack paths the provider has used against core banking, payment, custody or market infrastructure systems. Ask how the provider builds threat intelligence for a specific entity, since the targeted threat intelligence report drives the whole test. Treat generic penetration testing experience as a weaker signal than experience with the TIBER-EU process itself.
Check Swedish and regulatory fluency
Confirm that the provider can deliver reports, meeting minutes and deliverables in Swedish where your governance requires it, and that the team understands Swedish financial regulation, the Riksbank's role and Finansinspektionen's decisions on who must test. Ask how the provider keeps its procedures aligned with regulatory updates in Sweden, and who on its side will attend the authority's meetings. Ask for named contacts who can speak to the authority directly during the test.
Confirm who does the work
Ask for a named list of the people who will perform the red team work, the control team support and any readiness tasks, with their roles and time commitment. Ask who supervises each stage, how the test manager and control team see daily activity, and how the provider logs actions so they can be replayed in the closure phase. Find out whether any part of the work will be subcontracted, and if so, who approves that subcontractor.
Require a written fixed scope
Before any work begins, require a written scope that lists the systems, functions and flags in scope, the deliverables, the milestones and the responsibilities of each party. Ask how changes to scope will be approved and recorded, and what the contract says about the attestation and remediation plan. Ask for an itemized quote that separates the testing fees, reporting, purple teaming and any readiness work, so you can compare providers on the same basis.
Questions Swedish entities ask about TIBER-SE and DORA TLPT
What does the Riksbank TLPT fee cost, and how is it split?
The Riksbank charges an annual fee to entities that Finansinspektionen has ordered to perform threat-led penetration testing, starting from 1 January 2026. The fee covers the Riksbank's own costs of overseeing and coordinating the tests and issuing attestations. Under Riksbank regulation RBFS 2025:2, 70% of the total is split evenly between the entities that must test, and 30% is split by balance sheet total, so larger institutions carry a bigger share of that portion. The Riksbank decides each year's fee by 30 November of the following year. An entity that becomes obliged to test for only part of a year pays a prorated amount, and late payments may attract interest. Ask Finansinspektionen and the Riksbank for the current year's figures and payment dates, because the fee is set annually and is paid to the Riksbank, separately from any provider engagement.
Does a voluntary TIBER-EU test count as DORA TLPT in Sweden?
It can, but only if the test also meets the formal requirements set by the competent authority, which in Sweden is Finansinspektionen. The ECB states that the core requirements of DORA TLPT and TIBER-EU are identical, so a test completed under a TIBER-EU implementation is DORA TLPT-compliant when those formal requirements are met as well. TIBER-SE is the Swedish implementation that describes how DORA TLPT is carried out in Sweden. Finansinspektionen decides which entities must test, so an entity that tests voluntarily should confirm in writing with Finansinspektionen and the Riksbank whether the test will satisfy a future order before the work starts. The Riksbank fee applies to entities that Finansinspektionen has ordered to test, so the fee position also depends on that decision.
How long does a TIBER-SE test take from start to finish?
The framework sets phase limits rather than one total duration, so the end-to-end length depends on how each phase is run. The preparation phase lasts up to six months from the authority's written notification and covers scoping, the control team and procurement of providers. The testing phase includes at least 12 weeks of active red team testing. The closure phase, with replay and purple teaming, must be completed within 10 weeks of the end of active testing, and the remediation plan is due within 8 weeks of the authority's assessment. Procurement speed, the size of the scope, provider availability and the time needed to fix weaknesses are the main drivers. Ask the Riksbank to confirm the timeline that applies to your entity and agree the plan with your provider in writing before scoping begins.
What does a TIBER-SE test need from our own staff?
A TIBER-EU test involves five parties: the authority's TIBER Cyber Team and test manager, the entity's control team and blue team, the threat intelligence provider and the red team testers. Your own staff are the control team and blue team, so they take responsibility for coordinating the test on your side, supervising the red team's activity against the flags, and documenting how your detection and response performed. They also take part in the red and blue team reports, replay sessions, purple teaming, 360 degree feedback and the remediation plan. The time required depends on the number of systems in scope, how mature your monitoring is and how many remediation actions follow. Ask each provider to show, in the quote, the roles, meetings and deliverables that need internal participation so you can plan capacity.
Can our own team run the red team testing in-house?
No. Red team testing under a TIBER-EU test is carried out by external red team testers that the entity procures for the test, so internal staff cannot perform that role. Your team can prepare systems, own the controls being tested and act as the control team and blue team, but the attacking work must come from providers procured under the framework's rules. DeployOpen runs security testing, including red teaming, but it is not a substitute for the procurement process or the authority's approval of providers. Confirm with Finansinspektionen and the Riksbank which provider requirements apply before you select a firm. DeployOpen can support preparation, hardening and evidence, while the entity keeps ownership of its controls and decisions.
How is a fixed-scope partner engagement priced and scoped?
Most DeployOpen engagements are fixed-scope, which means the scope, deliverables and timelines are agreed in writing before work starts. DeployOpen does not publish a price list. A quote follows from the written scope, so the main drivers are the systems and environments in scope, the number of flags and scenarios to be prepared, the documents and evidence the entity needs for the assessment, and any remediation support. Ongoing support, upgrades and continuous testing are available as retainers, which are separate from the one-time engagement. Ask for an itemized quote that separates one-time work from recurring costs, names each deliverable and lists the assumptions about your environment. The Riksbank fee is not part of the partner quote and is paid to the Riksbank.
How DeployOpen prepares Swedish entities for a threat-led test
DeployOpen works on the preparation side of TIBER-SE testing: the systems, controls and evidence an entity needs before a threat-led test begins. We plan and implement self-hosted open-source platforms inside the client's own infrastructure, and we do not issue attestations, which come from independent assessors. Engagements run on a written scope agreed before work starts.
How we scope
- Confirm with the entity and its Finansinspektionen decision which DORA TLPT obligations apply and what the Riksbank has asked for.
- Agree in writing which systems, environments and ICT services fall inside the test perimeter and which are excluded.
- Map the entity's existing security tooling and logging against the preparation needs described in the TIBER-SE framework document.
How we build
- Plan and implement self-hosted open-source platforms in the client's own cloud accounts, data centers or air-gapped networks.
- Harden, integrate and document the platforms so the control team and blue team can monitor and respond during active testing.
- Set up configuration, backup and upgrade procedures so the environment stays stable through a multi-week red team engagement.
How we hand over
- Deliver the system documentation, configuration records and evidence files the entity needs to show its preparation work to the authority.
- Provide a handover session that walks the control team through runbooks, access paths and escalation steps before testing starts.
- Document open items and residual risks in writing so the entity can plan remediation after the test summary report is issued.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the initial engagement ends.
- Keep platform documentation current for the next test cycle, which the framework treats as roughly every three years unless the authority sets a different interval.
- Ask for a written quote based on the agreed scope. DeployOpen does not publish a price list.
