DORA Cybersecurity Consulting: Preparing for Resilience Testing

DORA’s digital operational resilience testing requirements are where many financial entities are discovering the gap between having an ICT risk framework on paper and being able to demonstrate resilience under test conditions.

For most in-scope entities, basic resilience testing (vulnerability assessments, scenario-based testing, and security assessments of critical ICT systems) is required at least annually. For entities identified as significant, threat-led penetration testing, or TLPT, introduces a considerably higher bar: live, adversarial testing against production systems that support critical functions.

The preparation gap we see most often is scoping. Entities frequently underestimate which systems and third-party ICT providers fall within scope of testing, particularly where critical functions depend on outsourced infrastructure. Getting this wrong either invalidates the test or leaves genuine exposure untested.

The second gap is operational readiness rather than technical readiness: incident response teams that have not rehearsed operating during a live test, unclear internal communication protocols, and, critically, a lack of clarity on how findings will be remediated and reported to the board and regulator afterwards.

Entities that treat DORA resilience testing as a one-off compliance milestone tend to find the exercise disruptive and the findings hard to act on. Entities that build a standing testing programme, with clear scoping, rehearsed response protocols and a remediation governance process, get a genuinely useful picture of their resilience, which is, after all, the point of the requirement.