DORA · pillar 4 of 5
Testing — and then the hard kind
An annual programme for everyone; threat-led penetration testing for some.
- 10 A programme, not an annual pentest Entities must establish a digital operational resilience testing programme as part of the ICT risk management…
- 11 Threat-led penetration testing, on production Entities identified by their authorities must additionally carry out threat-led penetration testing (TLPT) at least…
Start this pillar See the whole map
Read against Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS2), Commission Delegated Regulation (EU) 2025/301 — RTS on major ICT-related incident reporting on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.