scope_tlpt
Generate a DORA Article 26 TLPT scope document for financial entities, including phase plan, deliverables, RACI, and budget breakdown.
Instructions
Generate a DORA Article 26 TLPT scope document for a financial entity.
Args: entity_name: Legal name of the financial entity (e.g., "Acme Bank N.V."). entity_type: One of credit-institution / investment-firm / insurance / pension-fund / payment-institution / e-money-institution / market-infrastructure / CCP. sector: ISIC sector code (default: credit-institution). critical_functions: List of critical/important functions to be scoped (per Art. 26(2)). E.g., ["retail-payments", "trading-platform", "customer-onboarding"]. last_tlpt_date: ISO date of last TLPT (YYYY-MM-DD) — DORA mandates 3-year cycle. annual_budget_estimate_eur: Estimated TLPT engagement budget (drives RT-provider tier).
Returns: Structured scope document with phase plan, deliverables, RACI, and budget breakdown.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| entity_name | Yes | ||
| entity_type | Yes | ||
| sector | No | credit-institution | |
| critical_functions | No | ||
| last_tlpt_date | No | ||
| annual_budget_estimate_eur | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- meok_dora_tlpt_planner/server.py:118-203 (handler)The main handler function 'scope_tlpt' decorated with @mcp.tool(). Generates a DORA Article 26 TLPT scope document for a financial entity. Takes parameters like entity_name, entity_type, sector, critical_functions, last_tlpt_date, annual_budget_estimate_eur and returns a structured dict with entity info, scoped functions, cycle dates, TIBER phases, white-team RACI, RT provider requirements, and budget breakdown.
@mcp.tool() def scope_tlpt( entity_name: str, entity_type: str, sector: str = "credit-institution", critical_functions: list[str] | None = None, last_tlpt_date: str | None = None, annual_budget_estimate_eur: int | None = None, ) -> dict[str, Any]: """Generate a DORA Article 26 TLPT scope document for a financial entity. Args: entity_name: Legal name of the financial entity (e.g., "Acme Bank N.V."). entity_type: One of credit-institution / investment-firm / insurance / pension-fund / payment-institution / e-money-institution / market-infrastructure / CCP. sector: ISIC sector code (default: credit-institution). critical_functions: List of critical/important functions to be scoped (per Art. 26(2)). E.g., ["retail-payments", "trading-platform", "customer-onboarding"]. last_tlpt_date: ISO date of last TLPT (YYYY-MM-DD) — DORA mandates 3-year cycle. annual_budget_estimate_eur: Estimated TLPT engagement budget (drives RT-provider tier). Returns: Structured scope document with phase plan, deliverables, RACI, and budget breakdown. """ critical_functions = critical_functions or ["retail-payments", "core-banking"] today = datetime.now(timezone.utc).date().isoformat() # Cycle math: DORA Art. 26(1)(b) — TLPT every 3 years for significant/systemic FIs next_tlpt_due = "TBD" if last_tlpt_date: try: last = datetime.fromisoformat(last_tlpt_date).date() next_tlpt_due = last.replace(year=last.year + 3).isoformat() except ValueError: next_tlpt_due = "INVALID_DATE_FORMAT" # Budget tiering (rough; final RT-provider quotes vary) if annual_budget_estimate_eur is None: budget_tier = "UNKNOWN" elif annual_budget_estimate_eur < 100_000: budget_tier = "INSUFFICIENT — DORA TLPT typically EUR 250-500K minimum" elif annual_budget_estimate_eur < 500_000: budget_tier = "TIER-3 (mid-cap FI)" elif annual_budget_estimate_eur < 2_000_000: budget_tier = "TIER-2 (large FI)" else: budget_tier = "TIER-1 (G-SIB)" return { "entity": { "name": entity_name, "type": entity_type, "sector": sector, }, "scope": { "critical_functions_in_scope": critical_functions, "exclusions_to_document": [ "Functions outside DORA Art. 6(8) operational risk perimeter", "Sandbox/test environments not used by customers", "Functions covered by parent-level group TLPT in last 12 months", ], }, "cycle": { "last_tlpt_date": last_tlpt_date, "next_tlpt_due": next_tlpt_due, "cycle_basis": "DORA Art. 26(1)(b) — significant/systemic FIs every 3 years", }, "phases": TIBER_PHASES, "white_team_raci": WHITE_TEAM_RACI, "rt_provider_requirements": RT_PROVIDER_REQUIREMENTS, "budget": { "estimate_eur": annual_budget_estimate_eur, "tier": budget_tier, "breakdown_typical": { "threat_intelligence_eur": "30000-80000", "red_team_eur": "100000-500000", "white_team_internal_eur": "60000-200000 (FTE-equivalent)", "remediation_reserve_eur": "100000-500000 (post-test)", }, }, "scope_document_metadata": { "drafted_on": today, "drafted_by_tool": "meok-dora-tlpt-planner-mcp", "tool_version": "1.0.0", }, } - TIBER_PHASES constant — defines the three TLPT phases (preparation, testing, closure) with durations, deliverables, and stakeholders. Used by scope_tlpt in the returned 'phases' key.
TIBER_PHASES = { "preparation": { "duration_weeks": "4-8", "description": "Scope definition, white-team assembly, threat-intel commission", "deliverables": [ "TLPT scope document (critical/important functions selected)", "White-team Terms of Reference (ToR)", "Threat-intelligence provider engagement letter", "Red-team provider qualification (DORA Art. 27 RTS)", "Notification to lead overseer (TIBER-EU Cyber Team / national authority)", ], "stakeholders": ["white-team-lead", "ciso", "head-of-it-risk", "tlpt-cyber-team"], }, "testing": { "duration_weeks": "12-16", "description": "Threat intelligence + red-team engagement against live production", "deliverables": [ "Targeted Threat Intelligence (TTI) report", "Red-team Test Plan (TTP-mapped to MITRE ATT&CK)", "Live red-team engagement against production systems", "Daily situation reports to white-team", "Test summary findings report", ], "stakeholders": ["red-team", "threat-intel-provider", "white-team-lead"], }, "closure": { "duration_weeks": "6-10", "description": "Findings, remediation, replay, attestation", "deliverables": [ "Findings report with severity-ranked detected gaps", "Remediation plan (90/180/365-day milestones)", "Purple-team replay test (validate fixes)", "Final TLPT attestation (signed by white-team + RT lead)", "Submission to lead overseer for sign-off (Art. 26(7) DORA)", ], "stakeholders": ["white-team-lead", "remediation-owner", "lead-overseer"], }, } - RT_PROVIDER_REQUIREMENTS constant — lists DORA Article 27 red-team provider requirements. Used by scope_tlpt in the returned 'rt_provider_requirements' key.
RT_PROVIDER_REQUIREMENTS = [ "Independent from the financial entity (no commercial conflict in last 24 months)", "Hold ISO/IEC 27001 + ISO/IEC 27037 certifications", "Minimum 5 years of red-team engagements in financial sector", "Per Art. 27(2): qualified personnel with documented competence in MITRE ATT&CK", "Civil liability insurance ≥€10M", "GDPR-compliant data handling for any captured live data", "Background-checked staff for engagements above EUR 1B in critical functions", ] - WHITE_TEAM_RACI constant — defines white-team roles and responsibilities per TIBER-EU framework. Used by scope_tlpt in the returned 'white_team_raci' key.
WHITE_TEAM_RACI = { "white-team-lead": { "responsibility": "Overall test integrity + safety; sole authority to abort/pause test", "accountability": "Reports directly to CEO/CISO; signs final attestation", }, "operations-coordinator": { "responsibility": "Real-time situation awareness during red-team engagement; SOC-liaison", "accountability": "Briefs white-team-lead twice daily during testing phase", }, "evidence-custodian": { "responsibility": "Cryptographic chain-of-custody for all findings, screenshots, packet captures", "accountability": "Maintains tamper-evident artifact log; produces signed evidence pack at closure", }, "remediation-owner": { "responsibility": "Tracks remediation tickets to closure; coordinates purple-team replay", "accountability": "Reports to CTO/CISO; produces 90/180/365-day milestone reports", }, "comms-lead": { "responsibility": "Internal stakeholder communication; ensures NO leak of test status to blue-team", "accountability": "Reports to white-team-lead; signs comms-discipline attestation", }, } - meok_dora_tlpt_planner/server.py:115-117 (registration)Registration of scope_tlpt via the @mcp.tool() decorator on line 118. The FastMCP server is instantiated on line 22 as 'mcp = FastMCP("meok-dora-tlpt-planner")'.
# === Tools ===