The Bank of Greece and the Hellenic Capital Market Commission published the TIBER-GR National Implementation Document on 29 October, adopting the revised European TIBER-EU framework at national level. The framework covers threat-led penetration testing (TLPT), meaning controlled simulations of cyberattacks on critical production systems. A joint team, TLPT Cyber Team Greece (TCT-GR), is also being set up to coordinate the tests. For entities within the scope of the DORA regulation that meet the criteria of Commission Delegated Regulation (EU) 2025/1190, such testing is mandatory.

What it means: The announcement completes one piece of DORA's implementation in Greece, the European regulation on digital operational resilience in the financial sector. Until now, large banks and infrastructures knew they would have to carry out advanced testing, but the national document now sets out exactly how it will be done and who will oversee it. In TIBER tests, an independent team armed with intelligence on real threats tries to break into systems that are running normally, without most of the organisation's staff knowing. The aim is to see whether the organisation detects and handles an attack as it would in real life. The obligation mainly concerns systemic banks, market infrastructures and large providers, but the effects reach third-party technology suppliers too, because the tests often touch systems run by outside partners. IT firms serving banks should be ready to take part and share information. For cybersecurity companies, it creates demand for specialised red teaming and threat intelligence services that meet European specifications. TCT-GR takes questions through the Bank of Greece or the Capital Market Commission, depending on which authority is responsible.

Read the original on Τράπεζα της Ελλάδος

Related service: myDATA integrations

Related stories