Understanding DORA: Implications for Penetration Testing Practices

Posted on by Bogdan Tiron
REGULATIONS Understanding DORA Digital Operational Resilience Act – EU Financial Sector Compliance 1 ICT Risk Mgmt Governance & frameworks 2 Incident Reporting Major ICT incidents 3 Resilience Testing TLPT & threat-led tests 4 Third-Party Risk Critical provider oversight Banks Insurance Investment Firms Payment Providers Crypto-Asset Providers fortbridge.co.uk

The Digital Operational Resilience Act (DORA) is an EU regulation (2022/2554) that establishes uniform requirements for the security of network and information systems in the financial sector. It has been in force since 17 January 2025 and applies directly across all EU member states. DORA places specific obligations on financial entities regarding penetration testing, including mandatory threat-led penetration testing (TLPT) for significant institutions.

Table of contents

What DORA Is

DORA defines “digital operational resilience” as the ability of a financial entity to build, assure, and review its operational integrity and reliability, ensuring the full range of ICT capabilities needed to address network and information system security. This includes maintaining service quality throughout disruptions. The regulation covers five areas: ICT risk management, major incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing on cyber threats and vulnerabilities. It is binding in its entirety across all EU member states without requiring national transposition.

Scope

DORA applies to 21 categories of financial entities defined in Article 2, including:

  • Credit institutions (banks)
  • Payment institutions and e-money institutions
  • Investment firms and trading venues
  • Insurance and reinsurance undertakings
  • Crypto-asset service providers
  • Central securities depositories and central counterparties
  • Credit rating agencies and crowdfunding service providers

ICT third-party service providers that support these financial entities are also in scope, including cloud providers and managed service providers.

DORA Entity Scope Classification Which Financial Entities Fall Under the Digital Operational Resilience Act? TIER 1 – All In-Scope Entities (DORA Article 2) 1 Credit Institutions 2 Investment Firms 3 Insurance Companies 4 Payment Institutions 5 Crypto-Asset Service Providers 6 ICT Third-Party Service Providers 7 Trading Venues 8 Central Counterparties All entities above must comply with DORA ICT risk management, incident reporting, and third-party oversight requirements Subset identified by TIER 2 – TLPT Required (Significant Entities Only) Identified by competent authorities as “significant” Must perform TLPT at least every 3 years Based on TIBER-EU framework principles

Resilience Testing

Articles 24-25 require financial entities (except micro-enterprises) to establish a digital operational resilience testing programme as part of their ICT risk management framework. Key requirements include:

  • Annual testing of all ICT systems and applications supporting critical or important functions
  • Testing must follow a risk-based approach considering the entity’s ICT risk profile and the criticality of assets and services
  • Tests must be conducted by independent parties, whether internal or external. Internal testers must operate without conflicts of interest throughout the design and execution phases
  • The testing programme must include vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario-based tests, performance testing, and penetration testing
  • Central securities depositories and central counterparties must perform vulnerability assessments before any deployment or redeployment of applications and infrastructure supporting critical functions
  • All identified weaknesses must be classified, prioritised, and fully remediated with internal validation methodologies

TLPT Requirements

Articles 26-27 set out requirements for advanced threat-led penetration testing (TLPT), which applies to significant financial entities identified by competent authorities:

  • TLPT must be performed at least every three years (competent authorities may adjust this frequency)
  • Tests must cover critical or important functions and be performed on live production systems
  • Testing must follow the TIBER-EU framework
  • Where ICT third-party providers are in scope, pooled testing is permitted – multiple financial entities can jointly test a shared provider
  • External testers are the default requirement. Internal testers may be used only with competent authority approval, and must still engage an external threat intelligence provider. When internal testers are used, external testers must be contracted every third test
  • Significant credit institutions (classified under Article 6(4) of Regulation (EU) No 1024/2013) must always use external testers
  • Testers must be of the highest suitability and reputability, hold relevant certifications from an accreditation body in a member state, carry professional indemnity insurance, and demonstrate expertise in threat intelligence, penetration testing, and red team testing
  • Competent authorities identify which entities must perform TLPT based on impact factors, financial stability concerns, and the entity’s ICT risk profile and maturity level

After testing, the entity must submit findings, remediation plans, and documentation to the competent authority for attestation.

DORA TLPT Lifecycle Threat-Led Penetration Testing – Mandatory 3-Year Cycle 3 YEAR CYCLE 1 PREPARATION • Scope definition & critical function mapping • Threat intelligence gathering • Control team setup & governance 2 TESTING • Red team execution • Simulated attacks on critical functions • Live production environment testing 3 CLOSURE • Results analysis & findings report • Remediation planning & tracking • Regulatory reporting to authorities Execute Analyse & Report Restart Cycle Cycle restarts every 3 years DORA Articles 26-27 | RTS on TLPT Regulation (EU) 2022/2554

Third-Party Risk

Article 30 sets out requirements for contractual arrangements between financial entities and ICT third-party service providers. Contracts must include:

  • Full description of services, including subcontracting conditions
  • Specification of data processing and storage locations, with advance notification of changes
  • Data protection and confidentiality provisions
  • Obligation to assist during ICT incidents at no additional cost
  • Termination rights with minimum notice periods
  • Cooperation with competent authorities and resolution authorities
  • Participation in the financial entity’s ICT security awareness programmes

For critical or important functions, contracts must additionally require the ICT provider to participate and fully cooperate in the financial entity’s TLPT programme as defined in Articles 26 and 27.

! Internal vs External Tester Decision Matrix DORA TLPT – Choosing the Right Testing Approach Criteria External Testers Preferred by regulators Internal Testers Limited circumstances Independence Fully independent from the entity No conflicts of interest required Inherent conflict: testing own org Must prove separation of duties When Allowed Always allowed – default option Required for critical functions Only with competent authority approval Limited circumstances only Requirements • Professional indemnity insurance • Certified expertise in threat intel & pen testing • No prior audit/assurance engagement • Must use external threat intel provider • Demonstrated competence required • Subject to authority validation Cost • Higher cost – specialised firms • Insurance overhead included • Lower direct cost • Still needs external threat intel spend Regulatory Preference Strongly Preferred Default expectation under DORA Article 27 Conditional Only Must justify to competent authority Key takeaway: External testers are the default. Internal testers require explicit regulatory approval and must always engage an external threat intelligence provider (DORA Art. 27(2)).

Relationship with Other Frameworks

DORA complements other EU and UK cybersecurity regulations. The PSTIA 2024 addresses product security for connectable devices in the UK, while the NIS 2 Directive sets broader network and information security requirements across essential and important entities in the EU. Organisations subject to DORA that also handle payment card data should consider alignment with PCI DSS 4.0.1 requirements. For entities operating in healthcare, HIPAA and DiGA may also apply.

How FORTBRIDGE Can Help

FORTBRIDGE is a CREST-accredited penetration testing provider with experience in DORA compliance and TLPT engagements. Our senior consultants deliver threat-led testing aligned with the TIBER-EU framework, covering threat intelligence, red team execution, and regulatory reporting. Contact us to discuss your DORA resilience testing requirements.

About Post Author

Bogdan Tiron

Cloud Application Security Consultant/ Pentester

OSCP/CRT/GCP Architecture/GCP Security/DevSecOps

See author's posts