DORA resilience testing and TLPT explained
What does the basic testing programme (Arts. 24 and 25) require?
Every financial entity other than microenterprises must establish, maintain and review a digital operational resilience testing programme as an integral part of its ICT risk management framework (Art. 24(1) DORA). The key points:
- Risk-based approach taking into account the criticality of assets and services (Art. 24(3)).
- Independent testers, internal or external. Internal testers must be free of conflicts of interest (Art. 24(4)).
- Follow-up: procedures to prioritise and fully remedy all weaknesses found (Art. 24(5)).
- Annual frequency: systems and applications supporting critical or important functions are to be tested at least once a year (Art. 24(6)).
- Broad range of tests under Art. 25: from vulnerability assessments to scenario-based tests, end-to-end tests and penetration tests.
Added to that from the risk management chapter: business continuity, response and recovery plans and crisis communication plans are to be tested at least yearly (Art. 11(6)).
What is TLPT (threat-led penetration testing, Arts. 26 and 27)?
Financial entities designated by the authorities must additionally carry out threat-led penetration tests. Real attacker tactics are executed on live production systems supporting critical or important functions, at least every three years (Art. 26(1) and (2)). The regulatory technical standards for this, Delegated Regulation (EU) 2025/1190 (applicable since 8 July 2025), follow the TIBER-EU framework of the ECB (Art. 26(11)). Further details: every third test needs an external tester. Credit institutions classified as significant must use external testers only (Art. 26(8)). If ICT third-party service providers are within the scope of the test, pooled tests of several financial entities are possible (Art. 26(4)). After completion the authority issues an attestation that is mutually recognised across the EU (Art. 26(7)).
Basic testing programme and TLPT compared
| Aspect | Basic testing programme | TLPT |
|---|---|---|
| Who? | all financial entities other than microenterprises (scaled) | financial entities designated by the authorities |
| What? | vulnerability scans, scenario-based tests, end-to-end and penetration tests and more (Art. 25) | threat-led penetration tests based on real attacker tactics |
| Where? | test or production environment depending on the type of test | on live production systems supporting critical functions (Art. 26(2)) |
| How often? | critical systems at least yearly (Art. 24(6)) | at least every 3 years (Art. 26(1)) |
| By whom? | independent internal or external testers (Art. 24(4)) | testers under Art. 27; every third test external (Art. 26(8)) |
Who has to carry out TLPT?
Not every entity. The competent authorities designate the financial entities subject to TLPT on the basis of size, risk profile and importance for financial stability (Art. 26(8), third subparagraph). Microenterprises and entities under the simplified framework of Art. 16 are exempt. They meet their testing obligation through the basic testing programme or the regular testing of their business continuity plans.
Where do tabletop exercises fit in?
TLPT tests technical resilience. Alongside it, DORA explicitly requires that response, recovery and communication plans are tested (Art. 11(6)) and names scenario-based tests as part of the testing programme (Art. 25(1)). This is about people and procedures, and that is what tabletop exercises are for. Crisis team, escalation and reporting paths are rehearsed under time pressure. The after-action report is then the auditable evidence for the testing programme. That also applies to entities that never have to carry out a TLPT.
Frequently asked questions
What is TLPT under DORA?
Threat-led penetration testing is a threat-oriented penetration test that mimics real attacker tactics and is carried out on live production systems supporting critical or important functions (Art. 26(2)). The technical standards for it follow the TIBER-EU framework of the ECB (Art. 26(11)).
Who has to carry out TLPT, and how often?
Only financial entities designated by the authorities on the basis of size, risk profile and importance for financial stability. Microenterprises and entities under the simplified framework are exempt. TLPT is due at least every three years. The competent authority can increase or reduce the frequency (Art. 26(1)).
Does a tabletop exercise count towards the DORA testing programme?
Yes. Art. 25(1) explicitly names scenario-based tests as part of the testing programme. Art. 11(6) requires the business continuity, response and recovery plans and the crisis communication plans to be tested at least yearly. A documented tabletop exercise covers both requirements.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.