DORA Operational Resilience Testing: Art. 24-26 Programme

DORA distinguishes a baseline testing program that every entity must run, such as vulnerability scans and scenario analyses, from the more advanced Threat-Led Penetration Testing (TLPT), which is mandatory only for certain, typically larger and systemically important financial entities. Scope depends on the size and risk profile of the entity.

Threat-Led Penetration Testing simulates a real, targeted attack on critical systems carried out by an accredited external tester, based on the European TIBER-EU framework. It's mandatory for financial entities designated as systemically significant by the relevant supervisor; that designation is made individually, not simply based on company size alone.

Classic IT security tests usually check isolated technical vulnerabilities. DORA resilience testing additionally assesses whether the organization as a whole can respond to a successful attack: detection, containment, recovery, and communication are tested as an integrated process, not just the technical defense alone.

The baseline testing program should run at least annually, while TLPT tests for entities in scope are typically required every three years. Additional, event-driven testing is advisable after material changes to the IT landscape or a major ICT incident, independent of the regular test cycle.

Test results should be documented in a structured format, including identified vulnerabilities, their assessment, and the remediation measures taken with deadlines. For TLPT tests, confirmation from the relevant authority is additionally provided, verifying the test was conducted properly under the TIBER-EU standard.

Identified vulnerabilities need to be prioritized and tracked with concrete, time-bound actions; a test without a follow-on remediation process only meets DORA's requirement formally, not substantively. For TLPT tests, remediation of critical findings is also expected to be demonstrably complete before the next test cycle.