Skip to main content
Contact Us
  1. Home
  2. Penetration testing
  3. DORA penetration testing and TLPT

DORA testing, from baseline to threat-led

For financial entities, resilience testing is the law. We deliver the baseline testing Article 25 requires and support the three-yearly TLPT cycle for significant entities.

Get a quote See a sample report
Articles 24–27DORA

What the testing programme requires

  1. Art. 24A resilience testing programme
  2. Art. 25Testing of ICT tools & systems
  3. Art. 26Threat-led penetration testing (TLPT)
  4. Art. 27Requirements for TLPT testers
For significant entitiesRegulator-ready
01 · What it requires

DORA puts testing in law — two tiers of it

For financial entities, DORA Articles 24–27 make a digital operational resilience testing programme a legal requirement. Everyone in scope does baseline testing; significant entities also do threat-led penetration testing (TLPT) on a three-year cycle.

Article
What it requires
What it means for you
24
A sound, comprehensive testing programme
Testing is governed, risk-based and documented
25
Testing of ICT tools, systems and processes
Vulnerability assessments and penetration tests across critical ICT
26
Threat-led penetration testing (TLPT)
Intelligence-led red teaming for significant entities, roughly every 3 years
27
Requirements for TLPT and testers
Testers must meet strict independence and competence rules
We deliver the baseline testing (Art. 25) and support the TLPT cycle (Art. 26) with your providers; findings cover in-house and ICT third-party systems.
Talk to a DORA consultant
02 · Two tiers

Baseline testing, and TLPT for significant entities

Not every financial entity does TLPT. Knowing which tier you’re in decides the scope, the cost and the cadence.

Baseline testing (Art. 25)
TLPT (Art. 26)
Who
All in-scope financial entities
Significant entities, as designated by regulators
What
Vulnerability assessments and penetration tests
Intelligence-led red teaming on live production systems
Cadence
Risk-based, at least annually for critical systems
Roughly every three years
Tester rules
Independent and competent
Strict independence and accreditation (TIBER-EU aligned)
Find your tier
03 · Scope

Your testing reaches your ICT third parties too

DORA treats your critical ICT providers as part of your resilience. That extends the testing conversation beyond your own estate to the vendors you depend on.

Art. 25

Your own ICT

The critical systems and applications you run — the baseline of the programme.

Art. 28–30

ICT third parties

Critical providers fall inside your resilience obligations, with testing and audit rights in contracts.

Art. 26

The TLPT scope

For significant entities, TLPT can include services delivered by critical third parties.

Map your ICT scope
Starting from€4,000

Baseline testing; TLPT scoped separately

Baseline resilience testing is scoped like a standard engagement. TLPT is an intelligence-led red team, scoped per entity. See penetration testing pricing.

Get a fixed quote
05 · Questions

DORA penetration testing FAQ

Get a quote

More in our DORA and TLPT guide.

What does DORA require for penetration testing?
Articles 24–27 require financial entities to run a digital operational resilience testing programme. That means vulnerability assessments and penetration tests of critical ICT (Article 25), and — for significant entities — threat-led penetration testing (TLPT) roughly every three years (Article 26).
What’s the difference between baseline testing and TLPT?
Baseline testing (Article 25) is vulnerability assessment and penetration testing across your critical ICT, risk-based and at least annual for the most critical systems. TLPT (Article 26) is intelligence-led red teaming on live production systems, only required of significant entities, and governed by strict tester rules.
Who has to do TLPT?
Only financial entities designated as significant by their regulator, based on size and systemic importance. Everyone else in scope does the baseline testing in Article 25. We help you confirm which tier applies.
Does DORA cover our ICT providers?
Yes. DORA treats critical ICT third parties as part of your operational resilience, with testing and audit rights expected in contracts. Testing scope often extends to the services those providers deliver.
Is TLPT the same as a normal red team?
It’s a regulated, intelligence-led form of it, aligned with the TIBER-EU framework and bound by Article 27’s tester rules. Our red team practice runs the engagement; the DORA framing sets the rules around it.

Related tests and guides

All penetration testing services
Also forNIS2 penetration testingEvidence for Article 21Red teamRed team servicesObjective-based, tests detection and responseTest typeNetwork penetration testingInfrastructure, Active Directory, segmentationPricingPenetration testing pricingStarting prices and a fast quote
Scoping call

Scope your DORA testing

Tell us whether you’re a significant entity and which ICT systems are critical, and we’ll scope the right tier.

Teams we work with
MiloanColobridgeFinXFlypayYuria-PharmCashpointFinmeAmigo
Get your quote

A few details and we’ll send a fixed price. We reply within 1 business day.

Pixel icons by Streamline, CC BY 4.0.