Art.27 Requirements for testers for the carrying out of TLPT

Entities required to perform TLPT use only testers that are highly suitable and reputable, have the technical and organisational capability and specific expertise in threat intelligence, penetration and red team testing, hold certification from a Member State accreditation body or subscribe to a formal code of conduct or ethics framework, give independent assurance or an audit report on how they manage TLPT risks (including protection of confidential information and redress), and hold full professional indemnity insurance that also covers misconduct and negligence. These conditions apply to every tester, internal or external. Internal testers may be used only where the competent authority or the designated TLPT authority has approved it, the authority has verified sufficient dedicated resources and no conflicts of interest, and the threat intelligence provider is external (Art. 27(2)). Contracts with external testers must require sound management of TLPT results and data so they create no risk to the entity (Art. 27(3)).

Source: DORA (Regulation (EU) 2022/2554), Art.27. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.