Penetration testing for DORA
The EU Digital Operational Resilience Act has applied since 17 January 2025 to banks, payment firms, investment firms and crypto-asset service providers authorised under MiCA, among others. It requires a risk-based digital operational resilience testing programme that includes penetration testing. HYDN carries out that testing and reports in a form you can use as evidence.
What DORA asks for
Chapter IV of DORA covers digital operational resilience testing.
- Article 24 requires a sound, comprehensive and risk-based testing programme, carried out by independent parties (internal or external), with findings classified, prioritised and fixed.
- Article 25 lists the tests the programme should include, among them vulnerability assessments and scans, network security assessments, source code reviews where feasible, scenario-based tests and penetration testing. ICT systems that support critical or important functions must be tested at least yearly.
- Article 26 adds threat-led penetration testing (TLPT) for entities their competent authority designates.
Who it covers
DORA applies to most EU financial entities, including credit institutions, payment and e-money institutions, investment firms, insurers and crypto-asset service providers authorised under MiCA. It also brings critical ICT third-party providers under oversight.
How HYDN helps
- Penetration testing of the systems that support your critical or important functions: applications, APIs, networks, cloud and wallet infrastructure.
- Scenario-based testing and red team exercises that show how your detection and response hold up.
- Reports that classify and prioritise findings, as Article 24 requires, with a remediation check to confirm fixes.
For crypto firms preparing for MiCA authorisation, building the testing programme early saves a rush later.
Frequently asked questions
Does DORA apply to crypto companies?
Yes. Crypto-asset service providers authorised under MiCA are financial entities under DORA, so they need an ICT risk framework and a resilience testing programme like other financial firms.
What is TLPT?
Threat-led penetration testing under Article 26. It applies only to entities designated by their competent authority, must be carried out at least every three years, covers critical functions on live production systems, and has specific requirements for testers set out in Article 27. Talk to us about where we can help if you have been designated.
How often should we test under DORA?
Critical ICT systems and applications supporting critical or important functions must be tested at least yearly, alongside testing driven by your own risk assessment.
Published Updated