DORA and TLPT:
what testing you actually need

What DORA is#

DORA (Digital Operational Resilience Act) is Regulation (EU) 2022/2554 on digital operational resilience for the financial sector. It was adopted on 14 December 2022, published in the Official Journal on 27 December 2022 and has applied since 17 January 2025 (Art. 64) ¹. Being a regulation, not a directive, it applies directly in every member state.

Who it applies to and what testing you need#

Art. 2(1) lists 20 types of financial entities: credit institutions, payment and e-money institutions, account information service providers, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, fund managers, insurers and reinsurers, insurance intermediaries, occupational pension funds, rating agencies, crowdfunding platforms and others. Point (u) adds ICT third-party service providers ¹.

Excluded are, among others, insurers below the Solvency II thresholds, insurance intermediaries that are micro, small or medium-sized enterprises and pension funds with no more than 15 members (Art. 2(3)). Small and non-interconnected investment firms, exempted payment and e-money institutions and small pension funds apply a simplified framework (Art. 16), detailed in Delegated Regulation 2024/1774 ¹³.

The testing programme: what Art. 24 and 25 require#

• A testing programme as part of the ICT risk management framework, for all entities except microenterprises (Art. 24(1)) ¹.
• A risk-based approach: what is tested and how much follows from the risk assessment (Art. 24(3)) ¹.
• Tests are carried out by independent parties, internal or external; an internal tester requires sufficient resources and avoidance of conflicts of interest (Art. 24(4)) ¹.
• Procedures to prioritise and remediate, with validation that findings are closed (Art. 24(5)) ¹.
• At least yearly, appropriate tests on all ICT systems and applications supporting critical or important functions (Art. 24(6)) ¹.

Art. 25(1) lists the possible tests: vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing ¹. Central securities depositories and central counterparties perform vulnerability assessments before any deployment (Art. 25(2)).

TLPT: threat-led penetration testing#

TLPT (threat-led penetration testing) reproduces the tactics of real attackers, based on threat intelligence, on the entity’s live production systems. The entity sets the scope and the authority validates it; ICT providers in scope must take part, and the test can be pooled with other entities (Art. 26(2)–(4)) ¹.

The details are in Delegated Regulation (EU) 2025/1190, adopted on 13 February 2025, published on 18 June 2025 and in force from the 20th day after publication. Recital (1) states that the standard mirrors the TIBER-EU framework ².

The thresholds apply unless the authority’s assessment justifies an exception; otherwise the authority decides on impact and ICT risk criteria (Art. 2(1) of the RTS) ². The authority has a TLPT cyber team and appoints a test manager for each test, while the entity appoints a control team lead; the test is confidential and runs under a code name (Art. 3–4) ².

How a TLPT runs, with deadlines#

1. ≤ 3 months
   Initiation

   Initiation documents, from the authority’s notification (RTS, Art. 9) ².

2. ≤ 6 months
   Scope

   The scope document, approved by the entity’s management body (Art. 9) ².

3. ≥ 3
   Threat scenarios

   At least 3 scenarios, of which at most one not threat-led (Art. 10) ².

4. ≥ 12 weeks
   Active red-team phase

   The attack itself, with at least weekly reporting to the control team (Art. 11) ².

5. ≤ 4 weeks
   Red-team report

   From the end of the active phase (Art. 12) ².

6. ≤ 10 weeks
   Blue team, replay, purple teaming

   The defenders’ report, the attack replay and purple teaming, which is mandatory (Art. 12) ².

7. ≤ 8 weeks
   Summary and remediation

   The summary report to the authority and the remediation plan; the authority then issues the attestation (RTS Art. 12–13; DORA Art. 26(6)–(7)) ¹².

Who may carry out the test#

Art. 27(1) requires TLPT testers to ¹:

• be of the highest suitability and reputability;
• have technical and organisational capabilities, with expertise in threat intelligence, penetration testing and red teaming;
• be certified by an accreditation body in a member state or adhere to codes of conduct or ethical frameworks;
• provide independent assurance or an audit report on the management of TLPT risks;
• professional indemnity insurance, including against misconduct and negligence.

The RTS adds concrete selection thresholds (Art. 7): the threat-intelligence provider presents at least 3 references, with a manager of at least 5 years’ experience and another member of at least 2 years; external testers present at least 5 references, with a manager of at least 5 years and at least two testers with 2 years each of experience in pentesting and red teaming ². Internal testers need the authority’s approval and an external threat-intelligence provider; every third test uses external testers, and significant banks supervised by the ECB use external testers only ¹².

Reporting major incidents#

Art. 19 requires an initial notification, an intermediate report and a final report to the competent authority; clients are informed without undue delay when their financial interests are affected ¹. The classification of major incidents is in Delegated Regulation 2024/1772 and the deadlines in Art. 5 of Delegated Regulation 2025/301 ⁴⁵:

1. 4 h / 24 h
   Initial notification

   Within 4 hours of classification as a major incident and within 24 hours of the entity becoming aware of it ⁴.

2. 72 h
   Intermediate report

   Within 72 hours of the initial notification, even if nothing has changed ⁴.

3. 1 month
   Final report

   Within one month of the last intermediate report ⁴.

ICT providers: what goes into the contract#

The financial entity remains fully responsible for outsourced services and keeps a register of information on all ICT contracts (Art. 28), using the templates in Implementing Regulation 2024/2956 ¹⁶. For critical or important functions, Art. 30(3) requires the contract to include ¹:

• the provider’s obligation to participate and fully cooperate in TLPT (point (d));
• unrestricted rights of access, inspection and audit for the entity, a designated third party and the authority (point (e));
• exit strategies (point (f)).

Moldova: the NBM ICT Regulation#

In Moldova, DORA does not apply directly. The practical equivalent is the NBM Regulation on minimum requirements for managing ICT, information security and business continuity risks, approved by Decision No. 29 of 12 February 2025, in force since 20 March 2025, with compliance periods of 3, 9, 12 and 15 months ⁹. It applies to banks and branches of foreign banks, payment companies, e-money issuing companies and postal service providers (Art. 5(1)(a)–(d) of Law 114/2012); its explanatory note declares it aligned with the EBA ICT risk guidelines and DORA.

Romania: the BNR coordinates TLPT#

In Romania, Emergency Ordinance No. 14 of 5 March 2026, published in Official Gazette No. 188 of 11 March 2026, splits DORA supervision: the BNR (National Bank of Romania) for credit, payment and e-money institutions and account information service providers, and the ASF (Financial Supervisory Authority) for investment firms, insurers, intermediaries and pension funds ¹⁰. The BNR is the single public authority coordinating TLPT (Art. 5(2)); the ASF decides which of its entities carry out TLPT, the summary and remediation go to the BNR, which issues the attestation, and ASF entities forward it to the ASF within 30 days (Art. 5(3), Art. 11) ¹⁰. Romania is listed among the countries that have adopted TIBER-EU ¹¹.

Practical steps#

1. Establish your regime

   Full, simplified (Art. 16) or microenterprise; in Moldova, whether the NBM ICT Regulation covers you.

2. Inventory critical functions

   And the systems, applications and ICT providers behind them; the register of information starts here.

3. Write the testing programme

   Which Art. 25 tests, on which systems, how often and by whom, with independence documented.

4. Test and remediate

   Findings are prioritised and their closure validated by a retest (Art. 24(5)).

5. Prepare for TLPT

   If you are close to the thresholds: the control team, providers, the TLPT clauses in ICT contracts.

Frequently asked questions