DORA and Threat-Led Penetration Testing: What Articles 26–27 Actually Require

DORA gets discussed as if it invented a single new "DORA pentest" requirement that applies to every financial entity in the EU. It didn't. It created two genuinely different testing obligations, one of which applies broadly and one of which applies to a much narrower, regulator-designated group, and conflating the two leads to either over-scoping (and over-paying for) testing you don't need, or missing what you actually do.

The regulation, and what it covers

DORA, Regulation (EU) 2022/2554, became applicable across the EU on 17 January 2025. It applies to a broad definition of "financial entities" (banks, investment firms, insurers, payment institutions, crypto-asset service providers, and more) and, critically, extends to the critical ICT third-party providers those entities depend on, cloud providers, SaaS vendors, and similar suppliers can fall in scope even if they aren't themselves a financial institution.

Obligation one: general ICT testing (applies broadly)

Under DORA's digital operational resilience testing framework, all in-scope financial entities must run a program of ICT testing, vulnerability assessments, scenario-based testing, and other standard testing methods, proportionate to their size, risk profile, and criticality. This is the baseline, and it applies whether or not you're ever designated for the second, narrower obligation below.

Obligation two: Threat-Led Penetration Testing, or TLPT (applies narrowly)

Articles 26 and 27 introduce TLPT, a materially different, far more demanding form of testing that only applies to entities specifically designated by their competent supervisory authority, not to every financial entity by default. If you're designated, here's what actually changes:

• Scope: live production systems, including outsourced ICT services supporting critical or important functions, not a staging environment standing in for the real thing.
• Frequency: at least once every three years.
• Method: a realistic, multi-month attack simulation built on bespoke threat intelligence specific to your sector and threat landscape, using any means available to a real attacker, which can include social engineering and physical intrusion attempts, not just technical exploitation.
• Structure: the DORA Regulatory Technical Standards specify a mandatory purple-team phase (attackers and defenders working together after the test) and formal reporting back to the supervisory authority, this isn't a report that just goes in a drawer.
• Tester requirements (Article 27): testers must have demonstrable threat-intelligence and red-team expertise, hold accreditation from a recognized body or adhere to a formal code of conduct, provide independent assurance, and carry professional indemnity insurance. Some jurisdictions' TLPT frameworks also require a dual-vendor model, a separate threat-intelligence provider and testing provider working together, rather than one firm doing both.

Where this gets misunderstood

We regularly hear from teams who assume that because they're a financial entity, they need "the DORA pentest", meaning full TLPT, regardless of whether they've actually been designated for it. Being honest about this distinction matters: TLPT is a significant, multi-month undertaking with specific accreditation requirements behind it, built for entities whose supervisor has determined their systemic importance warrants it. Most financial entities' actual DORA obligation is the broader ICT testing program under obligation one, real, rigorous, but a fundamentally different scope and cadence than TLPT.

What to check first

• Confirm with your compliance or legal team whether your national competent authority has designated you (or is expected to) for TLPT specifically, this isn't something you opt into unilaterally.
• If you haven't been designated, your priority is a documented, proportionate ICT testing program, vulnerability assessments and penetration testing scoped to your critical functions, not TLPT.
• If you have been designated, tester accreditation under Article 27 isn't optional paperwork, verify it before engaging anyone.

Our penetration testing engagements are built for the broader ICT testing obligation every financial entity under DORA needs regardless of TLPT designation status. For the supply-chain and third-party ICT risk dimension DORA also covers, our security consulting work maps directly onto those gaps. If your organization sits outside the financial sector, see our companion piece on NIS2 and Article 21's risk-management measures, the broader EU cybersecurity baseline DORA sits alongside for the financial sector specifically. For DORA's third-party ICT risk dimension specifically, see third-party and supply chain risk, and for the payments-specific equivalent of a named testing requirement, see PCI DSS and penetration testing.