DORA Penetration Testing Requirements: Articles 24 to 27

Updated October 2026 6 min read

Quick answer. DORA does not require an annual pentest by name. It requires appropriate tests at least yearly on systems supporting critical or important functions, and TLPT at least every 3 years for entities their authority identifies.

Watch: DORA Penetration Testing Requirements: Articles 24 to 27 1:38

Video transcript

DORA does not require an annual pentest by name. It requires a risk-based testing program, and for some firms, threat-led penetration testing every three years.

Every financial entity except microenterprises runs the Article 24 program. Only entities their authority identifies run TLPT, a red team test of live production systems.

The floor is appropriate tests at least yearly on every system supporting a critical or important function. For asset-moving systems, that usually means a pentest.

TLPT runs in phases. Preparation and a validated scope, threat intelligence, red team testing, then closure and an attestation from the authority.

Active red team testing lasts at least twelve weeks. CASPs run TLPT only if their authority identifies them.

For TLPT, Article 27 wants testers who are reputable, certified and insured, and an external red team lead needs five years of experience.

For a crypto firm, start from functions. Custody needs pentests and signing code review, token issuance needs a smart contract audit, and client access needs authentication testing.

Guardian's offchain pentesting is led by Carlos Polop, with a retest on every test. Vanguard audits contracts with two independent teams, and compliance mapping ties each artifact to DORA.

Read the full guide, or talk to Guardian about a DORA test plan that holds up.

DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025.

It covers banks, payment and e-money institutions, insurers, crypto-asset service providers (CASPs) authorized under MiCA, and the other entities in Article 2.

Its testing rules sit in Chapter IV, Articles 24 to 27.

This article explains the technical and security side of DORA's testing requirements (Articles 24 to 27 of Regulation (EU) 2022/2554 and Commission Delegated Regulation (EU) 2025/1190). It is not legal advice; confirm how it applies to you with counsel.

The Two Tiers at a Glance

	Testing program (Articles 24 and 25)	TLPT (Articles 26 and 27)
Who	Every financial entity; microenterprises test under the lighter Article 25(3)	Entities their authority identifies; never microenterprises or Article 16(1) entities
What	A risk-based range of tests, such as scans, code reviews and pentests	An intelligence-led red team test of live production systems
How often	At least yearly on all systems supporting critical or important functions	At least every 3 years; the authority may raise or lower it
Who tests	Independent parties, internal or external	Testers meeting Article 27; external testers at least every third test
Supervisor	No approval step; may request the yearly ICT risk review (Article 6(5))	Validates the scope, takes part in every phase, issues an attestation

The Article 24 Program

Under Article 24, financial entities other than microenterprises need:

24(1): a "sound and comprehensive" program, part of the ICT risk management framework.
24(3): a risk-based approach, weighing the entity's risks and the criticality of its assets.
24(4): tests by independent parties, internal or external.
24(5): procedures to classify and remedy every issue, and confirm it is fully addressed.
24(6): appropriate tests at least yearly on all systems supporting critical or important functions.

All of it is proportionate to the entity's size, risk profile and services (Article 4(2)).

Article 25(1) lists penetration testing among the tests the program should include. The list is illustrative, and penetration testing is one item on it.

For smart contracts, see whether audits count as source code review.

Yearly testing of critical systems

Article 24(6) is the frequency rule. Entities must "ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions".

It sets a yearly floor per system, and leaves the type of test to the program. It does not require a yearly pentest on every system.

For internet-facing apps, signing services and systems that move client assets, it is hard to argue anything less than a pentest is appropriate. Document that judgment.

Article 3(22) defines critical or important functions. Map them first; the systems behind them set the yearly scope.

Separately, RTS 2024/1774 Article 10(2)(b) requires automated vulnerability scanning at least weekly on assets supporting critical or important functions.

Who May Test

Article 24(4) allows internal or external testers. Internal testers need sufficient resources, with conflicts of interest avoided "throughout the design and execution phases of the test".

TLPT is stricter. Article 27(1) requires testers that:

are of the highest suitability and reputability
have expertise in threat intelligence, penetration testing and red team testing
are certified by an accreditation body, or adhere to formal codes of conduct
give independent assurance on the sound management of TLPT risks
are fully covered by professional indemnity insurance

Internal testers need the authority's approval, and the threat intelligence provider must be external (Article 27(2)).

Entities using internal testers must use external testers every third test. Significant credit institutions may use external testers only (Article 26(8)).

Under RTS 2025/1190 Article 7, an external red team's manager needs at least 5 years of experience. At least two more testers need at least 2 years each.

TLPT Under Article 26

Article 3(17) defines TLPT as a framework that mimics real threat actors and delivers "a controlled, bespoke, intelligence-led (red team) test of the financial entity's critical live production systems".

The detailed rules are Commission Delegated Regulation (EU) 2025/1190 of 13 February 2025. It was published on 18 June 2025, in force from the twentieth day after publication.

It was drafted in accordance with TIBER-EU, and the ECB says it updated TIBER-EU to ensure its full alignment with these standards.

Who must perform TLPT

Under RTS Article 2, authorities must require TLPT from certain entities, unless an assessment shows it is not justified.

They include credit institutions identified as G-SIIs or O-SIIs, large payment and e-money institutions, central securities depositories, central counterparties, major trading venues and large insurers.

CASPs are not on that list. A CASP runs TLPT only if its authority identifies it; until then, Articles 24 and 25 apply.

How a TLPT runs

Preparation: initiation information, then a scope the authority validates (RTS Article 9, DORA Article 26(2)).
Threat intelligence: a targeted threat intelligence report on the entity (RTS Article 10).
Red team test: at least 12 weeks of active testing (RTS Article 11).
Closure: red and blue team reports, a replay and purple teaming (RTS Article 12).
Remediation: a findings summary and remediation plans (RTS Article 13).
Attestation: the authority attests the test met the requirements (DORA Article 26(7)).

A Test Plan for a Crypto Firm

Start from functions, not tools. Map the systems behind each critical or important function, including signers, custodians, RPC providers and oracles.

Pick tests on a risk basis, and test each system at least once a year.

Function	Systems behind it	Tests to schedule
Custody and withdrawals	Wallet infrastructure, signing service, withdrawal API, multisig and contract wallets	Infrastructure and API pentests, signing and contract code review, key compromise scenario
Trading	Web and mobile apps, order and account APIs	Web app and API pentests, performance testing
Token issuance and redemption	Mint and burn contracts, privileged roles, admin tooling	Smart contract audit, privileged role review, mint-to-redemption end-to-end tests
Client access	Login, recovery and 2FA flows, session handling	Web app pentest of authentication and authorization, vulnerability scans
Platform operations	Cloud accounts, CI/CD, secrets, vendor consoles	Infrastructure pentest, configuration review, network security assessment

Then set who may test what, who owns each fix, and what triggers an off-cycle test.

For providers, see the best Web3 pentesting firms. For budgets, see what a Web3 pentest costs.

Evidence to Keep

Keep evidence that the program runs, not just that it exists:

The program document: scope, risk-based rationale and yearly schedule (Article 24(1) and (3)).
An inventory of critical systems, with each one's last test date and type (Article 24(6)).
Per test: scope, window, method, testers and their independence (Article 24(4)).
Findings with severity, owner and due date (Article 24(5)).
Retest evidence that each fix was validated before the finding closed (Article 24(5)).
The yearly ICT risk management framework review report (DORA Article 6(5)).
For TLPT: the validated scope, test reports, findings summary, remediation plans and attestation.

How Guardian Helps

Guardian's offchain services are led by Carlos Polop, Head of Offchain Services, who co-founded and built HackTricks training.

The services cover pentests of infrastructure, web apps, APIs, browser extensions, SDKs and offchain automation, each closed out with a retest.

Onchain, Vanguard audits smart contracts with two independent teams and an invariant fuzzing suite.

Guardian's Regulatory & Compliance service maps each artifact to DORA. Pentest and audit reports map to Article 25, and contest results to Article 24.

For how DORA sits beside MiCA and other regimes, see Crypto Regulatory Compliance.

Frequently Asked Questions

Does DORA require annual penetration testing?

Not by name. Article 24(6) requires appropriate tests at least yearly on all systems supporting critical or important functions; Article 25 lists penetration testing as one such test. For asset-moving systems, a pentest is the usual answer.

Do crypto-asset service providers have to perform TLPT?

Only if their competent authority identifies them. CASPs are not among the categories RTS 2025/1190 Article 2(2) says authorities must require. But an authority can identify any financial entity on its impact, systemic character and ICT risk profile.

Can internal teams perform DORA penetration tests?

For the Article 24 program, yes, if independent, adequately resourced and free of conflicts of interest. For TLPT, internal testers need the authority's approval, external testers must be used every third test, and the threat intelligence provider must be external.

Sources

Build a DORA test plan that holds up

Guardian pentests your offchain stack, audits your contracts and maps every report and retest to the DORA articles it answers.

Talk to Guardian Explore regulatory compliance