DORA Digital Resilience Testing

Article 25 specifies the minimum testing activities that all in-scope financial entities (except microenterprises) must perform. These basic tests include vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests including switching and failover tests, compatibility testing, performance testing, end-to-end testing, and penetration testing.

The testing programme must cover all ICT systems and applications supporting critical or important functions. Article 24(6) specifies that financial entities shall identify all ICT systems and applications that support critical or important functions and shall test them at least yearly. This annual testing cycle is the minimum — the entity's risk assessment may dictate more frequent testing for particularly critical systems. The testing must be conducted by independent parties, either internal or external, though where internal testers are used, the entity must ensure they have sufficient resources and are free from conflicts of interest.

Article 25(2) requires financial entities to establish procedures and policies to prioritise, classify, and remedy issues identified during testing. This is not merely a documentation exercise — entities must demonstrate that test findings are tracked to resolution, that remediation is prioritised based on risk, and that the effectiveness of remediation measures is verified through re-testing. The testing programme must also be reviewed and updated regularly to reflect changes in the entity's ICT environment, threat landscape, and business operations. Competent authorities may request evidence of the testing programme, its results, and the remediation of identified issues as part of their supervisory activities.

A TLPT engagement follows a structured methodology derived from TIBER-EU, typically comprising three phases: threat intelligence, red team testing, and closure. In the threat intelligence phase, a qualified threat intelligence provider produces a targeted threat assessment identifying the most relevant threat actors and attack scenarios for the financial entity. This assessment must be based on real-world threat intelligence, not hypothetical scenarios, and must consider the entity's specific technology environment, business profile, and geographic exposure.

The red team phase involves an external testing team — the red team — attempting to compromise the entity's critical or important functions using the TTPs identified in the threat intelligence phase. Article 26(3) requires that TLPT be carried out by external testers meeting the requirements set out in Article 27. The entity's internal teams — blue teams — must not be informed of the test in advance, ensuring that the defensive response is genuine rather than rehearsed. The red team operates under strict rules of engagement agreed with the entity and the competent authority, which define the scope of permissible activities, escalation procedures, and conditions under which the test must be paused or terminated.

The closure phase involves a structured debrief in which the red team presents its findings, the blue team provides its perspective on the defensive response, and the entity develops a remediation plan addressing identified vulnerabilities. Article 26(6) requires that the financial entity submit to the competent authority a summary of the relevant findings, the remediation plans, and documentation demonstrating that the TLPT has been conducted in accordance with the regulatory requirements. The competent authority then provides an attestation confirming that the TLPT was carried out in compliance with the requirements, which the entity may share with other competent authorities to support mutual recognition and reduce duplicative testing under Article 26(4).

Article 27 sets out detailed requirements for the external testers conducting TLPT. They must be of the highest suitability and reputability, possess technical and organisational capabilities specifically required for threat intelligence and red team testing, and be certified by an accreditation body in a Member State or adhere to formal codes of conduct or ethical frameworks. They must also carry professional indemnity insurance covering risks arising from the conduct of the TLPT.

DORA's testing requirements are subject to the principle of proportionality, which recurs throughout the regulation. Article 4 establishes that financial entities shall implement the DORA requirements taking into account their size and overall risk profile, and the nature, scale, and complexity of their services, activities, and operations. For the testing programme specifically, Article 24(2) provides that the testing programme shall be proportionate to and commensurate with the size and the overall risk profile of the financial entity.

Article 16(1) provides that small and non-interconnected investment firms, payment institutions exempted under Directive (EU) 2015/2366, institutions exempted under Directive 2013/36/EU, electronic money institutions exempted under Directive 2009/110/EC, and small institutions for occupational retirement provision may apply a simplified ICT risk management framework. For these entities, the testing requirements are correspondingly reduced, though not eliminated. They must still conduct basic assessments and tests, but the scope and frequency may be adjusted to reflect their simpler ICT environments and lower systemic risk.

Microenterprises — defined as enterprises employing fewer than 10 persons and with annual turnover or balance sheet total not exceeding EUR 2,000,000 — are exempt from the resilience testing requirements of Chapter IV entirely under Article 24(1). This exemption reflects the recognition that imposing comprehensive testing programmes on the smallest financial entities would be disproportionate to both their risk profile and their capacity to comply. However, microenterprises remain subject to the basic ICT risk management requirements under Article 16.

For entities between the microenterprise threshold and the TLPT designation level, the practical challenge is determining the appropriate level of testing intensity. Competent authorities and the European Supervisory Authorities (EBA, EIOPA, ESMA) have published guidelines and technical standards that provide further detail on how the proportionality principle should be applied to testing programmes. Financial entities should consult these resources and document their proportionality assessment to demonstrate that their testing programme is commensurate with their risk profile.