Legalize / European Union / Delegated Regulation

Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria used for identifying financial entities required to perform threat-led penetration testing, the requirements and standards governing the use of internal testers, the requirements in relation to the scope, testing methodology and approach for each phase of the testing, results, closure and remediation stages and the type of supervisory and other relevant cooperation needed for the implementation of TLPT and for the facilitation of mutual recognition

Type Delegated Regulation

Publication 2025-06-18

State In force

Text As published

Department European Commission, FISMA

Source EUR-Lex

articles 17

This is the act as published. Later amendments are not folded into the text below: each one is a separate act in this repository and an entry in this law's history.

Reform history JSON API

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

Done at Brussels, 13 February 2025.

For the Commission

The President

Ursula VON DER LEYEN

[^ntr1-L_202501190EN.000101-E0001]: OJ L 333, 27.12.2022, p. 1, ELI: http://data.europa.eu/eli/reg/2022/2554/oj.

[^ntr2-L_202501190EN.000101-E0002]: Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ L 150, 9.6.2023, p. 40, ELI: http://data.europa.eu/eli/reg/2023/1114/oj).

[^ntr3-L_202501190EN.000101-E0003]: Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Banking Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/78/EC (OJ L 331, 15.12.2010, p. 12, ELI: http://data.europa.eu/eli/reg/2010/1093/oj).

[^ntr4-L_202501190EN.000101-E0004]: Regulation (EU) No 1094/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Insurance and Occupational Pensions Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/79/EC (OJ L 331, 15.12.2010, p. 48, ELI: http://data.europa.eu/eli/reg/2010/1094/oj).

[^ntr5-L_202501190EN.000101-E0005]: Regulation (EU) No 1095/2010 of the European Parliament and of the Council of 24 November 2010 establishing a European Supervisory Authority (European Securities and Markets Authority), amending Decision No 716/2009/EC and repealing Commission Decision 2009/77/EC (OJ L 331, 15.12.2010, p. 84, ELI: http://data.europa.eu/eli/reg/2010/1095/oj).

[^ntr6-L_202501190EN.000101-E0006]: Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).

[^ntr7-L_202501190EN.000101-E0007]: Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions, amending Directive 2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC (OJ L 176, 27.6.2013, p. 338, ELI: http://data.europa.eu/eli/dir/2013/36/oj).

[^ntr8-L_202501190EN.000101-E0008]: Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market, amending Directives 2002/65/EC, 2009/110/EC and 2013/36/EU and Regulation (EU) No 1093/2010, and repealing Directive 2007/64/EC (OJ L 337, 23.12.2015, p. 35, ELI: http://data.europa.eu/eli/dir/2015/2366/oj).

[^ntr9-L_202501190EN.000101-E0009]: Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Directive 2002/92/EC and Directive 2011/61/EU (OJ L 173, 12.6.2014, p. 349, ELI: http://data.europa.eu/eli/dir/2014/65/oj).

[^ntr10-L_202501190EN.000101-E0010]: Regulation (EU) No 600/2014 of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments and amending Regulation (EU) No 648/2012 (OJ L 173, 12.6.2014, p. 84, ELI: http://data.europa.eu/eli/reg/2014/600/oj).

[^ntr11-L_202501190EN.000101-E0011]: Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II) (OJ L 335, 17.12.2009, p. 1, ELI: http://data.europa.eu/eli/dir/2009/138/oj).

ANNEX I

Content of the project charter (Article 9(2)(a))

Item of information	Information required
Person responsible for the project plan, i.e. the Control Team Lead	Name Contact details
Testers	☐ internal ☐ external ☐ both
Communication channels selected in accordance with Article 9(2), point (d), and Article 9(4) point (a), including: (a) email encryption to be used (b) online data rooms to be used (c) instant messaging to be used
Codename for the TLPT
If any, critical or important functions the financial entity operates in other Member States	1. list of critical or important functions operated in another Member State 2. for each critical or important function, indication of the Member State or States in which they are operated
If any, critical or important functions supported by ICT third party service providers	3. list of critical or important functions supported by ICT third-party service providers 4. for each function, identification of the ICT third party service provider
Expected deadlines for the completion of the:	Expected deadlines for the completion of the:
(1) Preparation Phase, in accordance with Article 9	yyyy-mm-dd
(2) Testing Phase, in accordance with Articles 10 and 11	yyyy-mm-dd
(3) Closure Phase, in accordance with Article 12	yyyy-mm-dd
(4) Remediation plan in accordance with Article 13	yyyy-mm-dd

ANNEX II

Content of the scope specification document (Article 9(6))

The scope specification document shall contain a list of all critical or important functions identified by the financial entity.

For each identified critical or important function, the following information shall be included:

(a) where the critical or important function is not included in the scope of the TLPT, the explanation of the reasons for which it is not included;

(b) where the critical or important function is included in the scope of the TLPT:

(i) the explanation of the reasons for its inclusion;

(ii) the identified ICT system(s) supporting that critical or important function;

(iii) for each identified ICT system:

1. whether it is outsourced and if so, the name of the ICT third party service provider;

1. the jurisdictions in which the ICT system is used;

1. a high-level description of preliminary flag(s), indicating which security aspect of confidentiality, integrity, authenticity or availability is covered by each flag.

ANNEX III

Content of the targeted threat intelligence report (Article 10(5))

The targeted threat intelligence report shall contain information on all of the following:

1. The overall scope of the intelligence research including at least the following:

(a) critical or important functions in scope;

(b) their geographical location;

(d) relevant ICT third party services providers;

(e) period of time over which the research is gathered.

1. The overall assessment of what concrete actionable intelligence can be found about the financial entity, including:

(a) the employee usernames and passwords;

(b) the look-alike domains which can be mistaken for official domains of the financial entity;

(d) information posted by employees on the internet, related to the financial entity, which might be used for the purposes of an attack;

(e) information for sale on the dark web;

(f) any other relevant information available on the internet or public networks;

(g) where relevant, physical targeting information, including ways of access to the premises of the financial entity.

1. Threat intelligence analysis considering the general threat landscape and the particular situation of the financial entity, including, at least:

(a) the geopolitical environment;

(b) the economic environment;

1. Threat profiles of the malicious actors (specific individual/group or generic class) that may target the financial entity, including the systems of the financial entity that malicious actors are most likely to compromise or target, the possible motivation, intent and rationale for the potential targeting and the possible modus operandi of the attackers.

1. Threat scenarios: at least three end-to-end threat scenarios for the threat profiles identified in accordance with point 4 who exhibit the highest threat severity scores. The threat scenarios shall describe the end-to-end attack path and shall include, at least:

(a) one scenario that includes but is not limited to compromised service availability;

(b) one scenario that includes but is not limited to compromised data integrity;

1. Where relevant, a description of the non-threat-led scenario referred to in Article 10(4).

ANNEX IV

Content of the red team test plan (Article 11(1))

The red team test plan shall contain information on all of the following:

(a) communication channels and procedures;

(b) the tactics, techniques and procedures allowed and not-allowed for use in the attack, including ethical boundaries for social engineering;

(d) a description for each scenario, including:

(i) the simulated threat actor;

(ii) their intent, motivation and goals;

(iii) the target function(s) and the supporting ICT system or systems;

(iv) the targeted confidentiality, integrity, availability and authenticity aspects;

(v) flags;

(e) a detailed description of each expected attack path, including pre-requisites and possible leg-ups to be provided by the control team, including deadlines for their provision and potential usage;

(f) the scheduling of red teaming activities, including time planning for the execution of each scenario, at a minimum split according to the three phases a tester takes throughout the testing phase, respectively entering financial entities’ ICT systems, moving through the ICT systems and ultimately executing actions on objectives and eventually extracting itself from the ICT systems (in, through, and out phases);

(g) particularities of the financial entities’ infrastructure to be considered during testing;

(h) if any, additional information or other resources necessary to the testers for executing the scenarios.

ANNEX V

Content of the red team test report (Article 12(2))

The red team test report shall contain information on at least all of the following:

(a) information on the performed attack, including:

(i) the targeted critical or important functions and identified ICT systems, processes and technologies supporting the critical or important function, as identified in the red team test plan;

(ii) summary of each scenario;

(iii) flags reached and not reached;

(iv) attack paths followed successfully and unsuccessfully;

(v) tactics, techniques and procedures used successfully and unsuccessfully;

(vi) deviations from the red team test plan, if any;

(vii) leg-ups granted, if any;

(b) all actions that the testers are aware of that were performed by the blue team to reconstruct the attack and to mitigate its effects;

(i) vulnerability and other finding description including their criticality;

(ii) root cause analysis of successful attacks;

(iii) recommendations for remediation including indication of the remediation priority.

ANNEX VI

Content of the blue team test report (Article 12(4))

The blue team test report shall contain information on at least all of the following:

1. for each attack step described by the testers in the red team test report:

(a) list of detected attack actions;

(b) log entries corresponding to these detections;

1. assessment of the findings and recommendations of the testers;

1. evidence of the attack by the testers collected by the blue team;

1. blue team root cause analysis of successful attacks by the testers;

1. list of lessons learned and identified potential for improvement;

1. list of topics to be addressed in purple teaming.

ANNEX VII

Details of the report summarizing the relevant findings of the TLPT referred to in Article 26(6) of Regulation (EU) 2022/2554

The test summary report shall contain information on at least all of the following:

(a) the parties involved;

(b) the project plan;

(c) the validated scope, including the rationale behind the inclusion or exclusion of critical or important functions and identified ICT systems, processes, and technologies supporting the critical or important functions covered by the TLPT;

(d) selected scenarios and any significant deviation from the targeted threat intelligence report;

(e) executed attack paths, and used tactics, techniques and procedures;

(f) captured and non-captured flags;

(g) deviations from the red team test plan, if any;

(h) blue team detections, if any;

(i) purple teaming in testing phase, where conducted and the related conditions;

(j) leg-ups used, if any;

(k) risk management measures taken;

(l) identified vulnerabilities and other findings, including their criticality;

(m) root cause analysis of successful attacks;

(n) high level plan for remediation, linking the vulnerabilities and other findings, their root causes and remediation priority;

(o) lessons derived from feedback received.

ANNEX VIII

Details of the attestation of the TLPT referred to in Article 26(7) of Regulation (EU) 2022/2554

The attestation shall contain at least all of the following information:

(a) on the performed TLPT:

(i) the starting and end dates of the TLPT;

(ii) the critical or important functions in scope of the test;

(iii) where relevant, information on critical or important functions in scope of the test in relation to which the TLPT was not performed;

(iv) where relevant, other financial entities that were involved in the TLPT;

(v) where relevant, the ICT third-party services providers that participated in the TLPT;

(vi) in respect of testers:

1. whether internal testers were used;

1. whether Article 5(3), second subparagraph, was used by the financial entity;

(vii) the duration, in calendar days, of the active red team testing phase;

(b) where several TLPT authorities have been involved in the TLPT, the other TLPT authorities, and in which capacity;

ELI: http://data.europa.eu/eli/reg_del/2025/1190/oj

ISSN 1977-0677 (electronic edition)

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.