Law / European Union

DORA, Articles 24-27 (Digital Operational Resilience Testing and Threat-Led Penetration Testing)

Regulation (EU) 2022/2554, Arts. 24-27

In force since 17 Jan 2025.

A sector security regimes rule binding private bodies.

Private right of action

No

Obligation class

Security, Governance

As of 10 October 2026.

What it requires

• It reaches you if you are a financial entity under Article 2(1), points (a) to (t), of Regulation (EU) 2022/2554, unless Article 2(3) takes you out of the Regulation or your Member State has excluded you under Article 2(4). The testing program duties of Article 24 apply to you unless you are a microenterprise. The threat-led penetration testing duty of Article 26(1) applies to you only if your competent authority has identified you under Article 26(8) and you are neither a microenterprise nor an entity named in Article 16(1), first subparagraph. An ICT third-party service provider that is in the scope of a test takes part through the financial entity, which keeps full responsibility (Article 26(3)).
• Unless you are a microenterprise, establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of your ICT risk-management framework, follow a risk-based approach that takes account of the evolving landscape of ICT risk and the criticality of your information assets and services, and ensure that tests are undertaken by independent parties, internal or external, with sufficient resources and no conflict of interest where the tester is internal (Article 24(1) to (4)).
• Unless you are a microenterprise, establish procedures and policies to prioritize, classify and remedy all issues the tests reveal, set up internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed, and ensure at least yearly that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions (Article 24(5) and (6)).
• Include in the program a range of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing (Article 25(1)). If you are a central securities depository or central counterparty, perform vulnerability assessments before any deployment or redeployment of applications and infrastructure components and of the ICT services supporting critical or important functions (Article 25(2)). If you are a microenterprise, combine a risk-based approach with strategic planning of ICT testing (Article 25(3)).
• If your competent authority has identified you for threat-led penetration testing, carry out advanced testing by TLPT at least every 3 years, or at the frequency your competent authority sets, cover several or all critical or important functions on live production systems, assess which critical or important functions need to be covered, and have the scope validated by the competent authorities (Article 26(1) and (2)).
• Take the necessary measures and safeguards to ensure the participation of any ICT third-party service provider in the scope of the test, keep full responsibility for compliance with the Regulation, and apply effective risk management controls to mitigate the risks of any impact on data, damage to assets and disruption to critical or important functions, services or operations (Article 26(3) and (5)).
• When the testing ends and reports and remediation plans are agreed, give the designated authority a summary of the relevant findings, the remediation plans and the documentation demonstrating that the TLPT was conducted in accordance with the requirements, and notify your competent authority of the attestation you receive, the summary and the remediation plans (Article 26(6) and (7)).
• Contract only testers that meet Article 27(1): of the highest suitability and reputability, with technical and organizational capabilities and specific expertise in threat intelligence, penetration testing and red team testing, certified by an accreditation body in a Member State or adhering to formal codes of conduct or ethical frameworks, able to provide an independent assurance or an audit report on the sound management of the risks of TLPT, and covered by professional indemnity insurance. Use internal testers only with the approval of your competent authority or the designated single public authority, contract external testers every three tests, use only external testers if you are a credit institution classified as significant under Regulation (EU) No 1024/2013, and ensure that the threat intelligence provider is external to you (Article 26(8) and Article 27(1) and (2)).
• Ensure that contracts with external testers require a sound management of the TLPT results and that any data processing, including generation, storage, aggregation, drafting, reporting, communication or destruction, does not create risks to you (Article 27(3)).

Who enforces it

When LexLint raises it

When your app profile says your app provides financial services.

Back to the example  ·  Lint your app