Threat-led penetration testing: internal team, scope, and supervisory expectations
Meridian Bank is a significant credit institution with 4,000 staff and a large digital mortgage and payments franchise. Its ICT testing programme consists of an annual vulnerability scan, an application penetration test by the internal security team, and a tabletop exercise. The board has been told that DORA requires 'threat-led penetration testing' and asks whether the bank can use its internal red team to save cost. The internal team built the mortgage platform and reports to the CIO. The bank has never defined the scope of critical functions for advanced testing, has no threat intelligence feed, and has not approached the competent authority. The CISO proposes to run a TLPT in the next quarter using the internal team, without supervisor involvement, and to treat the exercise as a standard penetration test. The audit committee wants to know what is wrong with this plan.
1. Is Meridian required to perform TLPT, and what determines scope? What facts must be confirmed?
Read the worked answer
TLPT is not a generic annual pen test. Under DORA, advanced testing applies to financial entities identified as significant for that purpose, and TLPT must cover critical functions and services, not the entire estate. The bank should first confirm with the competent authority whether it is within the scope and what the applicable RTS require. Being a significant credit institution is a strong indicator, but the legal trigger and supervisory process must be verified.
Scope should be set from the critical functions and services that support them - for example, mortgage origination, payments and customer authentication - including people, processes and third-party dependencies. The bank must define threat intelligence sources, rules of engagement, production safeguards and remediation. It should not let the internal team define a convenient scope. Facts to confirm include the authority's designation, the 3-year cycle, whether any exemption applies, and whether the test must be supervised. The board should approve scope and constraints before testing.
2. Can the internal red team perform the TLPT? Evaluate independence, skills, and governance.
Read the worked answer
Potentially, but not as proposed. DORA does not automatically require an external firm, but testers must be independent, qualified and able to perform threat-led testing without conflicts. Meridian's internal team built the mortgage platform and reports to the CIO, so it lacks independence from the system under test and from IT management. Using it without independent oversight would weaken the test's credibility and could miss insider assumptions.
Acceptable options: use an independent internal team from a different reporting line with external quality assurance; use a qualified external provider; or combine internal knowledge with external testers under a controlled programme. The audit committee should approve the tester, scope and rules of engagement. The test should be threat-intelligence-led, with safeguards for production, confidentiality and remediation. Saving cost is not a sufficient reason to compromise independence. The board should also ensure the CIO does not control the findings.
3. What governance and remediation steps should follow the test?
Read the worked answer
After the test, the bank should produce a confidential report with findings, risk ratings and evidence; review it with the audit committee and senior management; and agree a remediation plan with owners, deadlines and budget. Critical findings should be escalated immediately, not held for the final report. The bank should retest or validate fixes, track them in the risk register, and feed lessons into the ICT risk assessment and testing programme. It should also protect the report's confidentiality and share it with the competent authority as required.
Governance points: the board should receive a summary, not raw exploit details; the CIO should not be the sole approver of remediation; and the third-party provider, if in scope, should be involved under contractual cooperation. The test is not complete when the report is delivered. The evidence of value is that findings change controls and that the next test confirms improvement.