A key distinction between TLPT in DORA and TIBER-EU frameworks and traditional red teaming lies in the role of test managers from the TLPT authority. While there is guidance for hiring Threat Intelligence (TI) and Red Team (RT) providers, as well as qualifications for the white/control team, there has been little focus on the test managers responsible for overseeing these complex exercises. Recognising this gap, I’ve developed a maturity model and specialised training program tailored to the unique needs of TLPT/TIBER test managers.
As opposed to a ‘normal’ pentest or red team test a TLPT/TIBER test is accompanied by a test manager from a Test Cyber Team/TLPT authority. Their role is to ensure that the test is run according to the framework and in a controlled manner. In order to perform this role properly they need quite a lot of skills, but this has not been documented.
As a trainer and coach for test managers of multiple TLPT authorities, I’ve developed a maturity model tailored to TLPT/TIBER test managers. This blog introduces the model, outlines the key responsibilities and knowledge domains of a test manager, and explains how bespoke training can help them excel.
If you are interested in test manager training or coaching please contact me.
Blog outline:
- Responsibilities for a TLPT/TIBERT test manager
- The knowledge domains for a TLPT/TIBER test manager
- Why Training and Coaching Matter
- Knowledge domains and maturity levels
Responsibilities for a TLPT/TIBER test manager
Based on my experience and the TIBER-EU and DORA TLPT frameworks, a TLPT/TIBER test manager has four main responsibilities:
- Test validation and attestation: The test manager ensures the test is conducted in line with the framework, reviewing and validating deliverables during the process like the scope and scenarios. When executed correctly, the TLPT authority can issue an attestation confirming the test meets TIBER-EU or DORA TLPT standards.
- Test Monitoring: While the control team (White Team) manages the test and its risks, the test manager provides additional oversight. Drawing on experience from previous tests, the test manager can identify and address deviations, such as excessive risks taken by the red team or misalignment with the chosen threat actor’s tactics, techniques, and procedures (TTPs). This is given less attention in DORA, but with the procurement of the red team being less strict proper attention should be given to this responsibility.
- Coordination and communication: Acting as a central point of contact, the test manager collaborates with the control team, red team, and other stakeholders. Their role is to help navigate unexpected events, make quick decisions in consultation with the other stakeholders, while taking into account possible (operational) risk for the tested entity.
- Sector resilience by sharing: In jurisdictions using TIBER-EU, test managers facilitate anonymised knowledge-sharing across entities. This fosters collective learning and improves the cyber resilience of entire sectors. While not mandated under DORA TLPT, this practice significantly enhances the financial ecosystem’s stability and security.
The knowledge domains for a TLPT/TIBER test manager
To fulfill their responsibilities, test managers must develop expertise in five main knowledge domains:
TLPT/TIBER process knowledge
Understanding the step-by-step process of running a TLPT/TIBER test is paramount. Test managers need to know what is required from providers and the control team at each stage.
IT and Red teaming knowledge
While test managers don’t need to perform red teaming themselves, they must understand IT infrastructure and the risks posed by red team actions. This enables them to ask the right questions and identify potential operational impacts.
Threat Intelligence knowledge
TIBER-EU and DORA TLPT are threat intelligence-led initiatives. Test managers must therefore ensure that the threat intelligence produced in the TI phase is relevant and it is properly applied during the RT phase in order to test the most relevant threats against the entity.
Project Management
Although the control team should act as the primary project manager, test managers provide essential support, especially when the control team is inexperienced. The test managers must maintain oversight of the test’s progress and mitigate risks.
Business knowledge
Each sector and entity has unique systems, procedures, and critical functions. Test managers must understand these nuances to ensure the tests target the right critical functions and accurately simulate real-world threats while understanding the risks faced by red teaming these systems.
Knowledge domains and maturity levels
It is almost impossible to find a test manager that starts highly skilled in all of the five knowledge domains. Therefore I’ve created a three-level maturity model to guide test managers’ development:
- Basic Level
At this stage, a test manager has foundational knowledge of the domain. For example when talking about the TLPT/TIBER-EU process a test manager has a good overview of the different process steps and deliverables. But without training/coaching or proper hands on experience this is not sufficient to fully fulfil all the responsibilities of a test manager in a TLPT/TIBER test. Therefore I would always pair a test manager on this level with a more experienced test manager.
- Advanced Level
Here, a test manager moves beyond theory, anticipating risks and ensuring smoother test execution. They’re capable of managing complex scenarios and minimising risk of impact on the operations of the tested entity.
- Leader Level
At the highest level, a test manager not only excels in their responsibilities but also drives innovation and continuous improvement. They enhance the learning experience for entities and contribute to the advancement of the testing framework itself.
Why Training and Coaching Matter
With DORA TLPT regulations coming into force on January 17, 2025, there is a growing demand for skilled test managers in the financial sector. Additionally, sectors outside finance are adopting the TIBER-EU framework. However, finding test managers proficient in all five knowledge domains at the “Leader” level is rare.
Training and coaching play a critical role in bridging this gap. By investing in tailored development programs, organisations can ensure their test managers not only meet regulatory requirements but also enhance the overall resilience of their sector. The maturity model of this blog ensures a structured approach to training and coaching test managers, enabling consistent growth across all domains.
Conclusion
The role of a TLPT/TIBER test manager is both challenging and vital. By defining clear responsibilities, knowledge domains, and a maturity model, we can better equip test managers to excel in their roles.
I would be happy to help your test managers grow their skills and confidence through tailored training and coaching, ensuring they contribute to both compliance and sector-wide resilience.
If you interested in training or coaching feel free to reach out for a chat!