Art.25 Testing of ICT tools and systems

The testing programme provides, proportionately under Article 4(2), for appropriate tests such as penetration and end-to-end tests, performance and compatibility testing, scenario-based tests, review of source code where feasible, scans and vulnerability assessments, analysis of open-source components, gap analyses, assessments of network security, reviews of physical security, and questionnaires with scanning software. Central securities depositories and central counterparties also run vulnerability assessments before deploying or redeploying applications or infrastructure components, and ICT services behind critical or important functions (Art. 25(2)). Microenterprises plan their tests by pairing a risk-based approach with strategic planning, weighing the resources and time spent against urgency, risk type, criticality and their capacity to take calculated risks (Art. 25(3)). The at least yearly testing of systems supporting critical or important functions is an Article 24(6) duty on entities other than microenterprises.

Source: DORA (Regulation (EU) 2022/2554), Art.25. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.