Digital Operational Resilience Testing under DORA
DORA's resilience-testing pillar (Articles 24–27) requires financial entities to establish a risk-based testing programme for ICT systems, and requires significant entities to perform threat-led penetration testing (TLPT) at least every three years.
The testing programme
Testing ranges from vulnerability assessments and scans to scenario-based tests and end-to-end testing, proportionate to the entity's size and risk profile.
How often, and for what
Article 24 treats the programme as a standing part of the ICT risk-management framework, not a one-off exercise commissioned before an audit. Article 25 sets a floor underneath that proportionality: every ICT system or application supporting a critical or important function must be tested at least once a year, and the duty applies to every in-scope entity other than microenterprises, not only the larger firms that also fall into TLPT scope. Central securities depositories and central counterparties carry an extra duty on top of that baseline: a vulnerability assessment before deploying or redeploying any application, infrastructure component, or ICT service supporting a critical or important function. Getting the scope wrong is a common gap in practice, usually because the testing plan is built from an outdated asset inventory rather than the current one. For Article 25's full test-type menu and a walkthrough of how to build a proportionate programme, see our Articles 24-25 testing requirements guide.
Threat-led penetration testing (TLPT)
TLPT follows the TIBER-EU framework and tests live production systems using threat intelligence. It must cover the critical functions identified under the ICT risk-management framework, and may involve ICT third-party providers. For a full walkthrough of who is in scope, how the test runs, and how to prepare before a notification arrives, see our TLPT requirements guide.
Frequently asked questions
How often is TLPT required under DORA?
At least once every three years for entities identified as significant, subject to authority discretion.
How often must ICT systems be tested under Article 25?
At least once a year for any ICT system or application supporting a critical or important function. Frequency and depth above that floor scale with the entity's size and risk profile. Microenterprises fall outside this specific annual-testing duty but remain subject to DORA's general ICT risk-management obligations.