Regulation (EU) 2022/2554 · has applied since 17 Jan 2025

DORA requires annual tests. Does your evidence hold up?

Around 22,000 financial entities in the EU fall under DORA, plus their critical IT service providers. Art. 24(6) requires annual testing of digital operational resilience. We deliver the technical part.

  • Report with mapping to the DORA articles
  • Report within 5 working days
  • Free initial call
around 22,000financial entities in the EU
Since Jan. 2025DORA has applied directly, without a national implementing law
Annualtesting obligation under Art. 24(6) DORA
€5mfine ceiling in Germany, section 56 KWG

Source: Regulation (EU) 2022/2554, recital 3

The testing field of Art. 25

Art. 25 DORA names a range of appropriate tests: vulnerability assessments, scenario-based tests, source code reviews, physical security reviews and penetration tests. From these, we provide evidence for six areas.

Art. 24 and 25 DORA · appropriate tests · annual
01

Network and systems

Segmentation, firewall configurations, exposed services, privileged access.

Infrastructure pentest
02

Access and identities

Active Directory, privileged accounts, MFA enforcement, lateral movement.

AD pentest
03

Applications and APIs

Banking portals, customer apps and APIs against the OWASP Top 10, with a source code review where needed.

Web app pentest
04

Physical security

Access control for server rooms, data centres and sensitive areas.

Physical pentest
05

People and awareness

Phishing, vishing and pretexting against your employees, the most common entry point.

Social engineering
06

Third parties and supply chain

Remote access, interfaces and third-party integrations. Art. 28 also requires a Register of Information.

Supply chain
we cover
Art. 26 DORA

TLPT under the TIBER-EU framework, every 3 years

Mandatory only for institutions the supervisor designates as significant: G-SIIs and O-SIIs, payment institutions with a payment volume of €150bn or more, insurers only from €1.5bn in gross premiums and €10bn in technical provisions.

outside our offering

From us you get the pentest and the technical evidence: a report with CVSS ratings, mapping to the DORA articles, a remediation plan and an executive summary.

Not from us: the regulatory classification of your company, legal advice, the register submission under Art. 28, or a certification.

What we deliver and what we do not

From us

  • Pentest within the agreed scope: infrastructure, Active Directory, web app and API, physical security, social engineering
  • Report with CVSS ratings and mapping to the DORA articles, usable for BaFin audits and internal audit
  • Executive summary for the board and management, prioritised remediation plan for IT

Not from us

  • The regulatory classification of your company, including the question of whether you fall under Art. 26
  • Legal advice on DORA and the submission of the register under Art. 28
  • A certification. We test and document, we do not issue a seal of approval

Art. 25 or Art. 26: which testing obligation applies to you?

The vast majority of the market covers its testing obligation entirely through Art. 25. A TLPT correctly carried out under TIBER-EU satisfies the DORA requirement at the same time.

Criterion Art. 25 DORA Art. 26 DORA · TLPT
Target groupAll DORA-obligated companiesInstitutions designated as significant
Test typePenetration test, vulnerability assessmentThreat-Led Penetration Testing under TIBER-EU
FrequencyAnnualEvery 3 years
EffortManageable, plannableVery high, specialised team
Our serviceFully coveredNot our offering

Who DORA applies to

DORA covers virtually the entire financial industry and its IT service providers. The full list is set out in Art. 2 DORA.

  • Banks and credit institutions
  • Insurers and reinsurers
  • Payment service providers
  • Investment firms
  • Investment funds and asset managers
  • Crypto-asset service providers (MiCA)
  • Fintechs and neobanks
  • Critical IT service providers
  • Exchanges and trading venues

Art. 4 DORA provides for a proportionality principle: scope and intensity depend on the size, risk profile and complexity of your services. The testing scope is scaled to risk, but the obligation does not disappear.

How the test runs

  1. Scope and article mapping

    Definition of the systems and processes to test, together with the articles that apply to your scope.

  2. Reconnaissance

    OSINT, network footprinting and planning of realistic attack paths.

  3. Technical test

    Manual testing within the agreed scope, across the six areas of the testing field.

  4. Analysis

    Every finding gets a CVSS rating and an article reference, for BaFin and internal audit.

  5. Report and handover

    Report within 5 working days, with a remediation plan and an executive summary. Walkthrough of the findings with your IT.

Frequently asked questions

How often does the DORA pentest need to be repeated?

Art. 24(6) DORA requires annual testing, Art. 25 names the methods. We also recommend a test after significant changes to the infrastructure, after incidents and after new systems are introduced.

Does DORA also apply to our IT service providers?

Yes. DORA requires financial entities to review their critical IT service providers. Conversely, a provider of critical functions can itself come under direct ESA oversight as a critical ICT third-party provider.

What happens if the evidence is missing?

DORA itself names no amounts, Art. 50 leaves them to the member states. In Germany, section 56 KWG sets up to €5m for a failure to report an incident and for a TLPT not carried out, and up to €500,000 for all other breaches – with no turnover percentage. BaFin can also impose requirements.

Ready for your DORA evidence?

In a free 30-minute initial call we clarify the scope. The fixed-price quote usually follows within 24 hours.

Book an initial call Get in touch
hello@access-granted.de
+49 9281 5918506
Everything about the service: access-granted.de/en/pentest/dora

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

Networks & trust seals
Trust Seal of the IT Security Association Germany (TeleTrusT)
Participant in the Alliance for Cyber Security
© AccessGranted X GmbH Last updated: September 23, 2026