DORA
Penetration testing for DORA
The EU’s Digital Operational Resilience Act has applied since January 2025. It requires financial entities to test their ICT systems regularly — and some to run threat-led penetration tests.
Request my free AI pentest£0 · no payment details · no obligation
What DORA requires
- A digital operational resilience testing programme (Article 24)
- Annual testing of ICT systems supporting critical or important functions
- Threat-led penetration testing (TLPT) at least every three years for entities designated by their regulator (Article 26)
UK firms
DORA applies to EU financial entities, but UK firms with EU operations, and ICT providers serving EU financial entities, are often asked to support it contractually.
A note on scope
TLPT is a specialised, regulator-led exercise. Our complimentary AI pentest is not TLPT, but it can help you find and fix application weaknesses ahead of formal testing.
Related
- Penetration testing for SOC 2
- Penetration testing for ISO 27001
- Penetration testing for PCI DSS
- Cyber Essentials Plus and penetration testing
Common questions
Ready to get started?
Request my free AI pentestAlso see: AI chatbot testing · Web app testing · Full penetration test · Guides