Art.26 Advanced testing of ICT tools, systems and processes based on TLPT

Only financial entities that their competent authority has identified for TLPT (under Article 26(8), third subparagraph, on impact, financial stability and ICT risk profile, applying Article 4(2)) must carry out threat-led penetration testing; Article 16(1) entities and microenterprises are excluded. Identified entities test at least every 3 years, a frequency the authority may shorten or extend for the entity's risk profile. Each test covers some or all of the critical or important functions on live production systems, including outsourced ones; the entity's scoping assessment is validated by the authority; ICT third-party providers in scope take part, or join pooled testing where their participation would harm other customers; risk management controls limit impact on data, assets and services; after testing, a summary of findings, remediation plans and documentation go to the TLPT authority, which issues an attestation. Testers meet Article 27; entities using internal testers contract external testers every third test, and significant credit institutions use only external testers.

Source: DORA (Regulation (EU) 2022/2554), Art.26. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.

Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.