DORA RTS on Threat-Led Penetration Testing (Commission Delegated Regulation (EU) 2025/1190) 7.1: Article 7(1)(a) to (f): Qualification of threat intelligence providers and external testers

For each TLPT the control team must ensure the threat intelligence provider and external testers supply detailed CVs and copies of appropriate certifications and hold professional indemnity insurance including misconduct and negligence; the threat intelligence provider gives at least three references and the external testers at least five from penetration and red team assignments; the threat intelligence team has a manager with at least five years of threat intelligence experience and at least one member with two years, broad knowledge, at least three prior assignments, no conflicting blue team duties and separation from the same firm's testers; and the red team has a manager with at least five years of penetration and red team testing and at least two testers with two years each, broad skills, at least five prior assignments, no conflicts and separation from the same firm's threat intelligence staff.