45. Article 26(11) of DORA requires the ESAs to define "requirements and standards governing the use of internal testers".
46. The possibility introduced currently in DORA to use internal testers is justified "in order to take advantage of internal resources available at corporate level" [Recital 61 of Regulation (EU) 2022/2554]. However, given the very sensitive nature of TLPTs, some safeguards have been established, both on the testers themselves and on their use by the financial entity.
47. As already mentioned, this is an important divergence from the current TIBER-EU framework, which so far only allows to use testers that are external to the tested entity. However, the possibility to use internal testers, is expected to be added in future revision of the TIBER-EU framework.
48. The starting point for the drafting of this part of the RTS was that these testers should carry out TLPTs as effectively and safely as external testers, without the security or the activity of the financial
…