Skip to content To submenu navigation

TIBER and DORA TLPT

Threat-led penetration tests aim to provide actors in the Swedish financial system a better prospect of their capacity to manage cyber risks, thus providing a base for strengthening the operational resilience in the financial system. The Riksbank is responsible to oversee and coordinate such tests for certain systemically significant actors. Based on the test results, the tested entity produces a remediation plan. When the test is finalised, the Riksbank provides the entity with an attestation confirming that the test was performed in accordance with the requirements.

TIBER

Threat Intelligence-Based Ethical Red Teaming (TIBER)-EU is a framework developed by the European Central Bank that makes it possible to, in a standardized way, test the resilience to cyber risks among actors in the financial system. The tests (known as red-team tests) involve the controlled simulation of a cyber attack on an organisation's employees, processes and technology. A test is not 'pass or fail,' but aims to identify weaknesses in the actor's digital infrastructure so that the actor may improve its operational resilience.

The main aims of TIBER-EU are to:

  • enhance the cyber resilience of financial entities and of the financial sector,
  • standardise and harmonise how red-team tests are performed in the EU, and
  • provide support for cross-border tests.

Actors who are not subjected to implement DORA TLPT (see below) can voluntarily carry out tests in accordance with the TIBER-SE framework. TIBER-SE is the Swedish implementation of the TIBER-EU framework. TIBER-SE is based on harmonised requirements of the TIBER-EU framework and uses the TIBER-EU framework documents in the testing process.

DORA TLPT

The EU Digital Operational Resilience Act (DORA) aims to ensure the cyber resilience of the European financial sector. The Regulation sets out regulatory requirements for risk management and ICT-security. Among other things, DORA requires the implementation of Threat Led Penetration Testing (TLPT) for financial entities with system-critical activities. The aim is for the tests to be used as a learning experience to strengthen the digital operational resilience of EU financial actors.

Finansinspektionen determines which financial entities that are obliged to carry out TLPT. The testing procedure of DORA TLPT is essentially aligned with the testing procedure in TIBER-SE. Thus, the TIBER-SE framework and associated documents are applied in the TLPT procedure as well. When a TLPT is finalised, the financial entity shall provide its remediation plan to the supervising authority (Finansinspektionen).

Was this information helpful? After your answear a textbox appears

Questions? Visit our FAQ on kundo.se (opens i new window).

Thanks for your feedback!

Your comment could not be sent, please try again later

Updated 21/10/2026