The EU's Digital Operational Resilience Act (DORA) has applied since 17 January 2025. Plenty of UK firms have filed it under "EU problem". For a large number of them, that's a mistake.
Who DORA reaches in the UK
DORA applies directly to EU financial entities, including banks, investment firms, payment and e-money institutions, insurers and crypto-asset service providers. UK firms feel it in three ways:
- UK groups with EU-regulated entities. Your EU entity is in scope, and its ICT and security often run on group infrastructure in the UK. In practice, the UK estate gets tested to DORA standards.
- UK ICT suppliers to EU financial entities. DORA requires EU financial entities to put specific contractual provisions in place with ICT third-party providers, including access, audit and cooperation requirements relevant to the service. If you sell SaaS, hosting, managed services or data to EU financial firms, expect those clauses in renewals.
- Due diligence. EU clients and partners will ask for evidence of testing and resilience whether or not your contract has been updated yet.
What DORA says about testing
DORA requires a digital operational resilience testing programme, proportionate to the firm's size and risk profile. Article 25 lists the kinds of test expected, and it names penetration testing explicitly alongside vulnerability assessments, network security assessments, gap analyses, source code reviews where feasible, scenario-based tests and end-to-end testing.
Key expectations:
- All ICT systems and applications supporting critical or important functions are tested at least yearly.
- Testing is carried out by independent parties, internal or external.
- Findings are prioritised, remediated and verified.
- Selected financial entities must also run threat-led penetration testing (TLPT) at least every three years, following the TIBER-EU methodology.
TLPT vs a "standard" pen test
TLPT is a full intelligence-led red team exercise against live production systems, with a dedicated threat intelligence phase, regulator oversight and a formal closure process. It is designed for the largest institutions. Most UK firms caught by DORA won't be in TLPT scope. They need a well-run annual testing programme that covers their critical or important functions.
A practical approach for UK firms
- Map critical or important functions and the systems behind them. If you're FCA-regulated, your operational resilience important business services are a good starting point.
- Build an annual test plan that covers those systems, not just your website.
- Make the test threat-informed. Prioritise the techniques that realistic attackers use against financial services.
- Keep an evidence trail: scope, independence, findings, remediation and retest. That's what an EU client's auditor or a supervisor will ask for.
- If you're a supplier, get ahead of the contract clauses. Having a recent independent test and a remediation record ready shortens procurement considerably.
The bottom line
If you have EU entities, EU financial clients or EU partners, DORA is already in your supply chain. The testing it expects is achievable for a mid-sized firm. It just needs to be planned around your critical functions and documented properly.
FAQs
Does DORA apply to UK companies?
DORA applies to EU financial entities and also establishes oversight for designated critical ICT third-party providers. UK groups and suppliers may face requirements through EU entities, contracts and due diligence.
Does DORA require penetration testing?
Yes. Article 25 names penetration testing as part of the digital operational resilience testing programme, with systems supporting critical or important functions tested at least yearly.
What is TLPT under DORA?
Threat-led penetration testing: an intelligence-led red team exercise based on TIBER-EU, required at least every three years for selected financial entities.
Sources & further reading
Talk to SMARTSEC
Need a DORA-aligned testing programme?
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
Talk to us about DORA testing →