TIBER-EU Framework Explained

Bottom Line

TIBER-EU is the direct predecessor to DORA TLPT and most national programmes are built on it. A completed TIBER-XX test may satisfy your first DORA TLPT cycle — but only if your competent authority confirms equivalence in writing, the scope and tester qualifications met the DORA RTS standards, and the test was recent enough to be credible. Engage your CA before your TLPT deadline, not after. An unrecognised TIBER test leaves you non-compliant with no runway to run a new one.

What Auditors Will Actually Look For

• Written confirmation (closure letter or equivalence decision) from your competent authority — verbal assurance is not sufficient.
• Whether your prior TIBER test scope covered all current critical functions — if your business has changed, partial scope is a problem.
• Tester qualification evidence: did the Red Team Provider meet the DORA RTS independence and qualification requirements, not just TIBER-EU standards?
• Date of the test: pre-2022 TIBER tests are unlikely to be recognised — the regulatory and threat landscape has materially changed.
• Remediation follow-through: even a recognised test is a red flag if major findings were never closed.

Common Mistakes

• Assuming a prior TIBER test automatically satisfies DORA without seeking CA confirmation — this is the most expensive mistake.
• Submitting a TIBER Red Team Report to the CA without a closure letter and expecting it to count.
• Using a TIBER test from 2019–2021 as evidence — the scope, standards, and threat landscape make this hard to defend.
• Not engaging the CA until after your TLPT deadline has passed — equivalence decisions take time.

The Three TIBER-EU Phases

Key Roles in a TIBER-EU Test

• White Team: small internal group (typically CISO + CRO) aware the test is running. Acts as liaison between red team and management. Must not tip off the Blue Team.
• Red Team Provider (RTP): the external provider conducting the simulated attack. Must meet TIBER-EU qualification standards — and for DORA recognition purposes, the DORA RTS qualification requirements.
• Threat Intelligence Provider (TIP): produces the Targeted Threat Intelligence report that shapes attack scenarios. Can be the same entity as the RTP or separate.
• Blue Team: the entity's own security operations and incident response team — typically unaware the test is live. Their detection and response is part of what is being assessed.
• Competent Authority: the national supervisor overseeing the exercise. Approves scope, receives reports, and issues the closure letter without which the test is not complete.

TIBER-XX National Variants

TIBER-EU is implemented at national level through country-specific variants. Each follows the same three phases but may have local adaptations in scope thresholds, provider registration requirements, and reporting formats.

Mutual Recognition: Does Your TIBER Test Count Under DORA?

DORA Art. 26(7) explicitly allows competent authorities to recognise tests conducted under equivalent frameworks. Whether your test qualifies depends on four factors:

• Recency: tests conducted before 2022 are unlikely to be recognised. The DORA RTS requirements introduced standards that older TIBER engagements were not designed to meet.
• Scope adequacy: did the test cover all functions and systems that are now classified as critical under DORA? If your business has changed, the original scope may no longer be sufficient.
• Tester qualification: did the Red Team Provider and Threat Intelligence Provider meet the DORA RTS independence and qualification requirements — not just TIBER-EU standards?
• CA confirmation: this is the non-negotiable step. Get written confirmation from your competent authority that your prior TIBER test satisfies your DORA TLPT obligation for the current cycle.

Key Differences: TIBER-EU vs. DORA RTS on TLPT

3-Step Action Checklist

• 1. This week: locate your most recent TIBER-XX closure letter (or confirm you have none). If you have one, check the date and scope against your current critical functions.
• 2. This month: contact your competent authority to initiate the equivalence discussion. Bring your closure letter, Red Team Report, and a current critical functions register.
• 3. This quarter: if equivalence is not confirmed, begin scoping a DORA-compliant TLPT — including provider procurement and CA pre-engagement — to avoid missing your 3-year cycle deadline.