Seven phases. 12 to 18 months from notification to attestation.

The competent authority issues a formal notification letter designating the entity for TLPT. This starts the regulated clock: initiation documents are due within three months (project plan, Control Team Lead appointment, communication protocols); the Scope Specification Document is due within six months.

The Control Team prepares the Scope Specification Document (SSD). This defines the Critical or Important Functions in scope, the underlying ICT systems and third-party services that support them, and the 'flags': specific objectives the red team must attempt to reach (for example, exfiltrating a sample of customer data or disrupting a payment-processing function). The SSD must be validated by the competent authority before testing can begin.

An external Targeted Threat Intelligence (TTI) provider produces a structured assessment of the threat landscape relevant to the entity: threat actors most likely to target it, their tactics, techniques and procedures, and likely attack vectors. The TTI report drives red team scenario design. Under DORA, the TI provider is always external, with no exception, including for entities permitted to use internal red teams.

The red team executes full kill-chain attack scenarios derived from the TTI report against live production systems. The Blue Team is unaware testing is taking place. Under the TLPT RTS, the active red team phase must last at least 12 weeks. Scenarios may include initial access, lateral movement, persistence, and impact simulation against the defined flags.

The Red Team Provider submits its full test report to the Control Team within four weeks of completing the active testing phase. This deadline is set by the TLPT RTS and runs in parallel with the purple teaming exercise, not sequentially after it. The report covers attack-path detail, evidence captures, flags reached, and observations on detection.

Once the active red team phase concludes, the Blue Team is read in. Red and blue teams jointly replay the attack: every action, every alert that fired or did not, every control that held or failed. The TLPT RTS requires the purple teaming exercise to occur, and the Blue Team report to be produced, within 10 weeks of the red team phase ending. Purple teaming is mandatory under DORA; it was only encouraged, not required, under the pre-2025 TIBER-EU framework. A combined remediation plan is prepared, prioritising findings by business impact and exploitability.

The entity submits the summary of findings, the remediation plan, and documentation demonstrating DORA-compliant execution to the competent authority. Only the summary goes to the regulator; the full technical report stays inside the entity. The competent authority reviews these and issues a formal TLPT attestation. The attestation enables mutual recognition: another EU competent authority can accept it in respect of the same entity's TLPT obligation in another Member State.