TLPT Provider RFP Template

Bottom Line

Your TLPT provider selection is a regulatory decision, not a procurement exercise. The DORA RTS sets explicit qualification requirements — your RFP must screen for them. A provider that has never delivered a CA closure letter is high-risk. Ask the hard questions before shortlisting, not after contract signature.

What Auditors Will Actually Look For

• Evidence that you issued a structured RFP aligned to DORA Art. 26 RTS qualification requirements.
• Documented evaluation criteria and scoring — not just a price comparison.
• Verification of tester independence: no team member worked for your entity in the past 3 years.
• PI insurance confirmation for the engagement scope.
• References from prior TLPT or TIBER-EU engagements — with CA closure letters as the evidence bar.
• A signed confidentiality and data processing agreement before any engagement activity begins.

Common Mistakes

• Shortlisting based on penetration testing credentials rather than TLPT or TIBER-EU track records — different skill sets.
• Not requesting a sample TTI report — the single best predictor of threat intelligence quality.
• Accepting "we can sub-contract" without asking who the sub-contractors are and whether they meet RTS standards.
• Skipping the methodology presentation — a provider who can't articulate their TLPT process clearly will struggle to execute it.

Section 1 — Organisation and Background

Establish baseline credentials before evaluating any technical proposal.

• 1.1 Provide your legal name, jurisdiction of incorporation, and years in operation.
• 1.2 Describe your TLPT and TIBER-EU engagement history in the EU financial sector. List references (anonymised if required).
• 1.3 How many TLPT/TIBER engagements completed in the past 3 years? In which sectors?
• 1.4 Have any of your TLPT reports been rejected or required significant rework by a competent authority? If yes, explain.
• 1.5 Provide current professional indemnity insurance coverage details and limit.

Section 2 — Tester Qualifications (DORA Art. 26 RTS)

Independence and technical competence are RTS requirements — not desirable extras.

• 2.1 List qualifications and certifications of the proposed red team lead and key team members (CREST, OSCP, CRTO, or equivalent).
• 2.2 Confirm that no proposed team member has been employed by or consulted for [Entity Name] in the past 3 years.
• 2.3 Describe your QA process: who reviews findings before the report is finalised?
• 2.4 Have team members received specific training on the DORA RTS on TLPT? Provide evidence.
• 2.5 If proposing to use sub-contractors, identify them and confirm they meet the same qualification standards.

Section 3 — Threat Intelligence Capability

Generic sector briefings fail the entity-specific intelligence requirement. Probe this section hard.

• 3.1 Do you provide threat intelligence in-house or through a third-party TIP? If third-party, identify them.
• 3.2 Describe your methodology for producing TTI specific to our sector, geography, and business model.
• 3.3 What primary and secondary intelligence sources do you use (closed-source feeds, dark web, OSINT)?
• 3.4 Provide a sample TTI report structure (redacted) from a prior financial sector engagement.
• 3.5 How do you ensure intelligence is current and not recycled from prior engagements?

Section 4 — Methodology and Execution

The methodology must cover the full attack lifecycle with explicit handling for high-risk scenarios.

• 4.1 Describe your end-to-end TLPT methodology from scope agreement through to report delivery.
• 4.2 What attack phases do you execute as standard? (Reconnaissance, initial access, post-exploitation, lateral movement, objective completion.)
• 4.3 How do you handle discovery of critical zero-day vulnerabilities or active compromise during the test?
• 4.4 Describe your escalation procedure if a test action causes unintended service disruption.
• 4.5 How do you ensure test activities remain within agreed scope and do not impact out-of-scope systems?
• 4.6 What is your approach to testing third-party provider components included in scope?

Section 5 — Reporting and Supervisory Deliverables

The reporting package must satisfy the CA, not just the internal client.

• 5.1 What deliverables do you produce as standard? (Red Team Report, Blue Team Report, Remediation Plan, Executive Summary.)
• 5.2 Provide a sample report table of contents from a prior TLPT engagement.
• 5.3 How do you classify and prioritise findings? What severity framework do you use?
• 5.4 Describe your experience engaging directly with competent authorities during and after TLPT exercises.
• 5.5 Do you offer re-testing of critical findings as part of the standard engagement?

Section 6 — Confidentiality and Data Handling

TLPT involves access to production systems and sensitive data. The engagement's own security must be contractually assured.

• 6.1 Describe your data handling and information security controls during the engagement.
• 6.2 How are findings, evidence, and reports stored and transmitted? What encryption standards apply?
• 6.3 What is your staff vetting process for personnel working on TLPT engagements?
• 6.4 How long is engagement data retained after project closure? Can we require deletion?
• 6.5 Confirm your willingness to sign a tailored confidentiality and data processing agreement.

Evaluation Scoring Matrix

Score all shortlisted providers against the same criteria. Document scoring before final selection.

3-Step Action Checklist

• 1. This week: Draft your long-list of candidate providers. Focus on TLPT and TIBER-EU track record — not general red team reputation. Check whether your CA maintains a recognised provider list.
• 2. This month: Issue a Request for Information (not yet a full RFP) to 5–7 providers using the Section 1–3 questions above. Use the responses to shortlist to 3 before issuing the full RFP.
• 3. This quarter: Issue the full RFP, score proposals against the evaluation matrix, and invite shortlisted providers to present their methodology. Complete provider selection before committing to a CA notification timeline.