DORA art. 26
TLPT (threat-led penetration testing)
Adversary-simulation testing against live production systems, mandated by DORA for significant financial entities.
TLPT is a DORA concept, not a NIS2 one. NIS2 requires you to assess the effectiveness of your measures under article 21(2)(f) but leaves the method open. Financial entities in scope of both should not assume a NIS2 effectiveness assessment satisfies DORA's testing programme.
Related terms
- Essential entity · Art. 3(1)
- Important entity · Art. 3(2)
- Significant incident · Art. 23(3)
- Early warning · Art. 23(4)(a)
- Size-cap rule · Art. 2(1)
- CSIRT · Art. 10