Who Faces DORA TLPT Requirements in Cyprus and What It Takes

DORA TLPT requirements apply only to financial entities whose competent authority has formally identified them under Article 26(8) of Regulation (EU) 2022/2554. In Cyprus, that will mean a small group of banks, payment and e-money firms, investment firms, insurers and market infrastructures. Each faces a multi-month, TIBER-EU-based attack simulation on live production systems at least every three years.

Who must meet DORA TLPT requirements in Cyprus?

Only firms your competent authority has identified. DORA has applied directly in Cyprus since 17 January 2025, with no national transposition, and it covers almost every regulated financial entity on the island. Threat-led penetration testing (TLPT) is reserved for a selected subset.

Article 26 removes two groups before any selection happens:

• Microenterprises, defined by reference to Recommendation 2003/361/EC: fewer than 10 persons employed and an annual turnover and/or balance sheet total not exceeding EUR 2 million.
• Entities under the simplified ICT risk management framework in Article 16(1), including small and non-interconnected investment firms under Regulation (EU) 2019/2033, certain exempted payment and e-money institutions, and small occupational pension funds.

Everyone else can be selected, but no one is obliged to act until notified. The notice comes in writing from the Central Bank of Cyprus, CySEC, the ECB or another competent authority. There is no public register, and authorities coordinate identification across sectors and Member States before sending letters.

The selection rules sit in the regulatory technical standards on TLPT, Commission Delegated Regulation (EU) 2025/1190, drafted by the European Supervisory Authorities. They combine two layers:

• Quantitative triggers for certain categories, such as systemically important banks and payment institutions, e-money institutions, insurers and market infrastructures above size thresholds set in the RTS.
• Qualitative assessment of other entities: systemic importance, substitutability, interconnectedness, cross-border footprint, criticality of functions, ICT maturity, incident history and supervisory findings.

Authorities can exclude a firm that meets a trigger if TLPT would be disproportionate, and add firms below the thresholds. A mid-sized EMI with heavy EU passporting, or a CIF that clears large volumes for other firms, should assume it is under review even without a letter.

The Cypriot sector is dominated by small CIFs, EMIs and payment firms. Our estimate is that single digits to low tens of Cyprus entities will be identified in any cycle. That is an informed estimate, not an official figure.

Who is the TLPT authority in Cyprus?

It depends on who supervises you. The RTS lets a Member State with several competent authorities designate a single TLPT authority, but Cyprus has not clearly announced one in its published DORA guidance, so confirm the arrangement directly with your supervisor.

The TLPT authority is a participant, not just a recipient of a report. Its test managers validate your scope, review the threat intelligence, monitor the red team phase and sign the attestation at the end.

Your likely counterpart:

• European Central Bank, through the Single Supervisory Mechanism, for significant Cypriot banks. The ECB runs its own TIBER-EU-based programme for these institutions.
• Central Bank of Cyprus for less significant credit institutions, payment institutions and e-money institutions.
• CySEC for Cyprus investment firms, UCITS management companies, AIFMs, crypto-asset service providers under MiCA and market operators.
• Superintendent of Insurance for insurance and reinsurance undertakings.

How is DORA TLPT different from a normal penetration test?

A penetration test looks for vulnerabilities in a defined system. TLPT simulates a realistic adversary trying to reach a business objective in production, and measures whether your people, processes and technology detect and stop it.

Three features set it apart. It is intelligence-led: scenarios come from threat intelligence about the actors who target your firm, with tactics mapped to MITRE ATT&CK. It is objective-based: the red team pursues objectives such as moving funds in a payment system or reaching client data behind a critical function. And it runs on live production systems, with most defenders unaware.

Exercise	Threat intel input	Environment	Main output	Typical frequency
Vulnerability assessment	None	Production or staging	List of known weaknesses	Monthly to quarterly
Penetration test	Generic	Usually staging or scoped production	Exploitable findings per system	Annual or per release
Red team exercise	Optional	Production	Detection and response gaps	Ad hoc
Purple teaming	Often	Production	Tuned detections, shared with defenders	Ongoing
Bug bounty	None	Public-facing assets	Individual reports	Continuous
DORA TLPT	Mandatory, targeted	Live production, critical functions	Red team report, remediation plan, attestation	At least every 3 years

No other row satisfies TLPT, and TLPT replaces none of them. Your PCI DSS penetration tests, ISO/IEC 27001 audit work and SWIFT CSP assessments continue alongside it.

What should firms that are not identified do?

Most Cyprus firms will land here, and DORA still expects real testing from them. Articles 24 and 25 require a risk-based digital operational resilience testing programme: vulnerability assessments, network security assessments, scenario-based tests and penetration tests, scaled to your size and risk.

NIS2 adds its own testing expectations for in-scope non-financial entities. For financial entities, DORA is the sector-specific act, so its testing rules are the ones your supervisor will check.

The best value for a firm below the TLPT line is a scoped red team operation run on TIBER-EU principles: a threat-informed scenario, a business objective and a White Team. It delivers most of the learning at a fraction of the cost, and leaves evidence a supervisor will respect if you are identified later.

Our NIS2 and DORA compliance readiness work starts with exactly that gap analysis: which tests your programme already covers and which critical functions have never been attacked end to end.

How does a TIBER-EU test run, and who does what?

DORA TLPT follows TIBER-EU, which the ECB first published in 2018 and updated in 2025 to align with the DORA RTS. For an identified firm it is not optional guidance, because the RTS methodology is built on it.

1. Preparation. The board sponsors the test, a White Team forms, and the scope is drafted around critical or important functions. You procure threat intelligence and red team providers, agree rules of engagement and submit the scope for validation.

2. Threat intelligence. The provider produces a targeted report on your firm: exposed attack surface, likely actors (ransomware crews, financially motivated groups, state-linked operators) and realistic scenarios for the red team.

3. Red team testing. The red team writes a test plan and executes it against production for at least 12 weeks. For a Cyprus payment firm, a plausible path runs from phishing or a compromised supplier account, through Microsoft 365 and Active Directory, into the payment back office.

4. Closure. The red team and the Blue Team each report, then replay the attack together. You write a remediation plan. The TLPT authority receives a summary of findings, the plan and evidence the test met the standard, then issues an attestation other authorities can recognize. Detailed reports stay with you and are not published.

The roles must stay distinct: the White Team (a small internal group that controls safety and escalation), the Green Team (threat intelligence), the Red Team, the Blue Team (your SOC, mostly unaware) and the authority’s test managers.

Internal red teamers need prior approval from your competent authority. Under Article 27, firms using internal testers must contract external testers every third test, and significant banks must use external testers only. Where internal testers are used, the threat intelligence must come from outside the firm.

TIBER-EU expects threat intelligence and red teaming from separate, independent teams. Some providers offer both under internal segregation; get the TLPT authority’s agreement before signing. Separate contracts remove the conflict-of-interest question entirely.

Qualification matters more than brand. Expect to evidence named test managers, demonstrated threat intelligence and red team experience, professional indemnity insurance and references from comparable exercises. A vendor that runs good annual penetration tests is not automatically qualified.

How long does TLPT take, what does it cost, and which providers are in scope?

Plan for 4 to 7 months from scope validation to attestation (practitioner estimates; the only fixed regulatory figure is the 12-week testing minimum), and longer for a first exercise.

• Preparation and procurement: 1 to 3 months, more if you must run tenders.
• Threat intelligence: 4 to 8 weeks.
• Active red team testing: at least 12 weeks.
• Closure, replay and reporting: 1 to 2 months.

For a mid-sized entity, external provider costs commonly land between EUR 100,000 and EUR 400,000 or more, depending on scope, the number of critical functions and how threat intelligence and red teaming are contracted. No official EU figure exists.

Remediation is usually the larger bill. A red team that reaches domain admin in week four hands you work on identity hygiene, segmentation, monitoring and supplier access that can take a year to close. The White Team lead also loses a large share of their week to the exercise for months.

ICT third-party providers are in scope when they support the critical functions under test. Article 26 keeps the financial entity fully responsible for the test, including the provider’s participation.

Where testing a shared platform, such as a public cloud, could affect other customers, DORA allows pooled testing: several financial entities test the provider together, led by one designated entity. This is where contract terms matter. Your DORA clauses with critical ICT providers should already secure testing cooperation. Negotiating access mid-cycle is slow, and you will have little bargaining power.

For Cyprus firms, look first at outsourced core banking or payment platforms, managed SOC providers and group IT companies that host your Active Directory or Microsoft 365 tenant.

What should you prepare before a notification arrives?

Start the slow work now: procurement, contracts, governance and detection maturity. Firms that wait for the letter usually lose the first two or three months to tendering and legal reviews.

• Map critical or important functions to systems, data flows and ICT providers, consistent with your DORA register of information.
• Pre-qualify providers for threat intelligence and red teaming, with framework agreements ready to activate.
• Fix contracts with critical ICT providers to secure test cooperation.
• Draft the safety framework: stop conditions, an out-of-band communication channel, executive escalation, insurance cover and a legal opinion on accessing production systems and personal data.
• Prepare a data processing agreement with the red team, since testers will likely see personal data covered by GDPR.
• Test your detection first. A short assumed-breach or purple team exercise shows whether your SOC can see lateral movement at all. We covered this in whether your SOC can see an intrusion under DORA.

Subsidiaries of foreign groups have one more question to settle. A group-level test can cover your Cyprus entity, but only if the scope explicitly includes its critical functions and its own authority is involved. A parent’s test on shared group systems does not count automatically.

If your Cyprus EMI runs its own payment rails or client onboarding stack, get those functions written into the group scope, or expect a separate test. Expect supervisory follow-up either way: remediation items resurface in ongoing supervision, and the next cycle checks that the same attack path no longer works.

FAQ

Do all DORA-regulated firms in Cyprus need TLPT?

No. Only firms identified by their competent authority must run TLPT. Microenterprises and entities under DORA's simplified ICT risk management framework are excluded entirely.

How often is DORA TLPT required?

At least every three years for identified entities. The competent authority can raise or lower the frequency based on the firm's risk profile.

Is TIBER-EU mandatory for DORA TLPT?

The DORA RTS on TLPT is built on the TIBER-EU methodology, and the ECB updated TIBER-EU in 2025 to align with it. In practice, an identified firm follows TIBER-EU phases, roles and deliverables.

Can our internal security team run the TLPT red team?

Only with prior approval from your competent authority. Firms using internal testers must bring in external testers every third test, significant banks must use external testers only, and threat intelligence must then come from an external provider.

How much does a DORA TLPT cost?

Practitioner estimates put external provider costs for a mid-sized entity at roughly EUR 100,000 to EUR 400,000 or more. Remediation often costs more than the test.

Will the regulator publish our TLPT results?

No. The authority receives a summary of findings, the remediation plan and supporting documentation, then issues an attestation. Detailed reports remain confidential.

If your firm expects a TLPT notice, or wants a TIBER-EU-style rehearsal first, see how we run DORA TLPT threat-led penetration testing for Cyprus financial entities.