MFSA Guidance on Threat-Led Penetration Testing (TLPT) under DORA and TIBER-EU

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt MFSA Releases Its Guidance on Threat-Led Penetration Testing (‘TLPT’) within the Maltese Jurisdiction The Malta Financial Services Authority (‘MFSA’, ‘the Authority’) is designated as the TLPT Authority for Threat-Led Penetration Tests carried out under the Digital Operational Resilience Act (‘the DORA Regulation’) (Regulation (EU) 2022/2554) and the relevant Regulatory Technical Standard, i.e. Commission Delegated Regulation (EU) 2025/1190 on Threat-Led Penetration Testing (‘the RTS’) within the Maltese Jurisdiction. Threat-Led Penetration Testing (‘TLPT') will be undertaken using the European Framework for Threat Intelligence-Based Ethical Red Teaming (‘TIBER-EU’). This approach ensures a standard and robust assessment of operational resilience. The MFSA has previously communicated with relevant stakeholders to gauge industry views on introducing TIBER-EU in Malta. The general consensus was that the introduction of the framework locally, would enhance the cyber resilience of Financial Entities (‘FEs’). FEs identified by the MFSA that are required to undergo TLPT will therefore need to adhere with the TIBER-EU Framework throughout the whole TLPT process, with the MFSA taking the role as the TIBER Authority in Malta. To further supplement this, the MFSA has published the “TIBER-MT and DORA TLPT-MT National Implementation Document” (‘the Document’) as part of adopting the TIBER-EU Framework at a national level. The Document states that FEs licenced by the MFSA and identified to perform TLPT under the DORA Regulation by the Authority, will undergo a TIBER-MT test, with the MFSA acting as the TIBER-MT Authority. The TIBER-MT test is recognised under the TIBER-EU Framework and leads to attestation, provided that the mandatory requirements under the DORA Regulation and the RTS are met throughout the TIBER-MT test. The FEs licenced by the MFSA are urged to read the Document for further information. To reach the TIBER-MT Authority, kindly contact us through tlpt@mfsa.mt. For further information, kindly go to the Threat-Led Penetration Testing section of the Supervisory ICT Risk and Cybersecurity page within the MFSA website. 7 July 2025