Baseline test or TLPT: which DORA evidence do you need?

Since 17 January 2025, DORA has applied directly to the entire financial sector in the EU, replacing the BaFin circulars BAIT, VAIT, ZAIT and KAIT for DORA-regulated firms. Art. 24 and 25 require regular security testing from everyone, Art. 26 and 27 a Threat-Led Penetration Test from a few.

  • Baseline test under Art. 24/25 DORA
  • TIBER-DE-oriented approach
  • Free initial consultation

One switch, two paths

Classification

Whether an institution counts as significant under Art. 26/27 DORA is decided by the supervisor. Not by the institution itself, and certainly not by its service provider. Your path depends on this classification.

Path A · Art. 24/25 DORA

Basic security testing

Applies to
every DORA-regulated financial company, without exception
Frequency
at least annually
Test environment
test or production systems, depending on scoping
Project duration
typically a few weeks
Who may test
an experienced pentest team is sufficient
Our contribution

Fully covered as a self-contained project. Every finding gets a severity, a remediation measure and the matching DORA article, and the report can be used in a BaFin review.

Path B · Art. 26/27 DORA

Threat-Led Penetration Test

Applies to
only institutions the supervisor classifies as significant, among others from €150bn in annual payment volume
Frequency
at least every three years
Test environment
exclusively real production systems in live operation
Project duration
at least 12 weeks following the TIBER-DE process
Who may test
only testers who meet the requirements of Art. 27 DORA
Our contribution

Readiness assessment as preparation, with a prioritised list of gaps. We do not run the TLPT itself.

TIBER-DE is the German framework for TLPT: operated by the Deutsche Bundesbank, supervised on substance by BaFin.

Where attackers start at banks and insurers

  • Art. 25

    Core banking systems and payments

    Legacy core banking platforms and payment interfaces running protocols that are rarely reassessed.

  • Art. 25

    Online banking

    Customer portals and banking APIs: a direct target and at the same time the system with the largest damage on successful access.

  • Art. 25

    Branch network

    Public areas, teller zones and meeting rooms with network access, a physical attack surface that is often missing from a purely IT view.

  • Art. 28

    ICT third-party providers

    Outsourcing partners, cloud providers and payment service providers, which DORA defines as a risk of its own in Art. 28.

Relevant modules

  • Social Engineering and vishing

    Phishing and voice phishing simulations that are documented at the same time as a scenario-based test under Art. 25(1) DORA.

  • Web App Pentest

    Online banking portals, customer portals and APIs to OWASP standard, including weaknesses typical of the financial sector such as BOLA.

  • Infrastructure Pentest

    Core banking systems, network segmentation between branches and head office, and the access paths of ICT third-party providers.

What we deliver and what we don't

From us you get the penetration test and the technical evidence: a report with a severity for each finding, a remediation plan, a management summary and mapping to the matching DORA article. What does not come from us: the supervisory classification of your institution, legal advice, certification and the TLPT under TIBER-DE itself.

What a baseline test report looks like

Illustrative excerpt from path A: every finding with the DORA article it relates to.

Finding Reference Sample
  1. Vishing simulation: customer service discloses credentials after an authority pretextArt. 25(1)
  2. Online banking API: weak authorisation check between customer accounts (BOLA)Art. 25
  3. Third-party VPN: access without multi-factor authenticationArt. 28
  4. Branch: network port in the customer area reachable without port securityArt. 25
6 findings · remediation plan included · DORA mapping Art. 25 and 28

Illustrative example, no real customer data.

Vishing is test and evidence at once

Art. 25(1) DORA counts scenario-based tests among the permitted methods, and Art. 13(6) requires awareness programmes. A controlled call posing as IT support, branch management or an external auditor serves both.

BaFin rates phishing and vishing as the most relevant entry vectors; they are the ones tested most often in TLPTs. A sector-wide observation by the supervisor, not a case study of a single company.

Frequently asked questions

Why are we exempt from NIS2 if we already fall under DORA?

Under section 28(6) BSIG, the core BSIG duties (sections 30, 31, 32, 35, 36, 38 and 39) do not apply to financial entities subject to DORA; DORA takes precedence as a special rule.

Are our IT service providers affected too if we ourselves are a bank?

Indirectly, yes. Art. 28 DORA obliges you to keep a register of all ICT third-party providers and to assess their risk. Critical providers can even fall under direct supervision by the European Supervisory Authorities.

What does a DORA pentest cost?

That depends on the scope: the number of systems and branches, whether vishing and physical testing are included, and whether it is a baseline test or TLPT readiness preparation. After the free initial consultation you get a fixed-price quote.

Ready for your DORA evidence?

In 30 minutes we work out whether a baseline test is enough for you or whether TLPT readiness preparation makes sense. After that you receive a quote, with no obligation.

All about the industry: access-granted.de/en/branchen/finance

Book a consultation Get in touch

Contact

Address
Albert-Einstein-Straße 1, 95028 Hof
E-Mail
hello@access-granted.de
Phone
+49 9281 5918506

AccessGranted X GmbH · HRB 7266 · Hof (Saale)

Company

Services

Regulatory pentests

Industries

© AccessGranted X GmbH Last updated: September 18, 2026