Penetration Testing for DORA (TLPT)
Penetration testing for DORA supports the digital operational resilience testing pillar (Articles 24–27). It ranges from vulnerability assessments through to threat-led penetration testing (TLPT), which significant entities must perform at least every three years.
The testing spectrum
DORA expects a proportionate, risk-based programme: scans, vulnerability assessments, scenario-based tests, and, for entities identified as significant, TLPT on live production systems following the TIBER-EU framework. Testing must cover the critical functions identified in the ICT risk-management framework.
Choosing testers
TLPT requires testers that meet DORA's competence and independence requirements. Several specialist security firms and generalists offer DORA-aligned testing, compare them in the directory.
How the rollout looks in practice
TLPT designation and scheduling happens at national level, so the clearest signal of how the three-year cycle is playing out comes from individual competent authorities rather than the EU-wide rules alone. France's ACPR set out one example in its 2025 annual report, published 21 May 2026: monitoring of TLPT for the largest supervised entities began in summer 2025 and is being phased in over three years, matching the rollout Articles 26-27 anticipate rather than requiring every significant entity's first test on the same date. Entities designated for TLPT should expect their home competent authority to run a similar phased process, typically starting with a direct identification letter rather than a public list, since several national authorities treat the underlying designation roster as confidential.
Frequently asked questions
Is TLPT mandatory for every financial entity?
No. TLPT is required only for entities identified as significant by their competent authority; others follow the broader risk-based testing programme.
How often is TLPT required?
At least once every three years for significant entities, subject to authority discretion.
What framework does DORA TLPT follow?
TLPT is based on the TIBER-EU framework and uses threat intelligence to test live production systems.
Is the list of entities required to run TLPT published?
Generally no. Competent authorities typically notify designated entities directly, for example by identification letter, rather than publishing a roster, though the phased rollout itself is described in authorities' own public reporting, such as France's ACPR noting TLPT monitoring began in summer 2025.