DORA compliance testing for financial firms and the ICT providers behind them.
DORA has applied since 17 January 2025, and its testing articles ask for evidence, not promises. We run the tests, tie each finding to the article it answers, and retest after you fix.
Start a one-month trial
What DORA asks of your testing
Chapter IV of the regulation covers digital operational resilience testing. Four ideas matter most to a QA team.
A programme, every year
Risk-based tests on the systems behind your critical or important functions, at least yearly.
A broad set of tests
Vulnerability scans, penetration tests, scenario, performance and end-to-end tests, among others.
Threat-led tests for some
Your supervisor decides which firms must do them, at least every three years, with qualified testers.
Providers in the picture
ICT providers behind critical functions need contracts and exit plans, and the exit plans need testing.
A plain-words summary, not legal advice. Smaller firms carry lighter duties. Read the key requirements and what compliance gives you, then confirm your own scope with your compliance team.
Four places resilience is checked, and how we check each
Your applications and APIs
Functional, performance and end-to-end tests, plus security tests on web, API and mobile, using our AI Security Toolkit and manual penetration testing.
evidence: test runs, scan output, reproduction stepsFailure and recovery
We restore a backup and read the result, fail a service over, and see what the customer sees while a part is down. See disaster recovery testing.
evidence: restore logs, timings, screenshotsThe incident path
When something breaks, does the alert fire, does the log show who did what and when, and does the ticket carry what a report to your supervisor needs?
evidence: alert traces, log excerpts, ticket recordsYour side of third-party links
What your system does when a payment, cloud or data provider times out, sends bad data or is switched off. We test your integration, not the provider.
evidence: fault-injection results, fallback behaviourBefore a threat-led test (TLPT)
If your supervisor requires one, red-team time is expensive. We help you arrive ready: known findings fixed and retested, test environments checked, scope prepared. The test itself is run by the testers you appoint.
Evidence a supervisor or auditor can read
A test evidence pack
What was tested, when, on which version, with the raw results attached.
Findings tied to DORA articles
Each finding has steps to reproduce, a severity, and the article it relates to.
A retest after your fix
We check that the fix holds and mark the finding closed. Retests are billed at the same hourly rate as other testing time.
A summary for your compliance team
One page a non-engineer can read: what passed, what failed, what is still open.
| ID | Finding | DORA | Severity | Status |
|---|---|---|---|---|
| F-014 | Nightly backup restores with a failed integrity check | Art. 12 | High | Retested, closed |
| F-021 | No alert when the payment provider returns errors for 5 minutes | Art. 17 | Medium | Fix in progress |
| F-027 | Export API serves records the user's role should not see | Art. 25 | High | Retested, closed |
Your environment, your data rules, our engineers
Paper first
NDA and data processing agreement are signed before anyone gets access.
Your environment
We test in the environment you name, with the accounts you give us, on masked or synthetic data where you can provide it.
People who review
Our tools run the checks. A QA engineer reads every result, because automated output can be confidently wrong.
Findings in one place
Results go into BugBoard, our own test management tool, and export to your tracker.
What we do for DORA, and what we do not
We can
- Test your applications, APIs and mobile apps, and report against the DORA articles.
- Run vulnerability scans and penetration tests on web, API and mobile.
- Test backup restore, failover and the incident path.
- Retest your fixes and hand over an evidence pack.
- Prepare you for a threat-led test.
We cannot
- Certify you. There is no DORA certificate: your supervisor judges compliance.
- Run the threat-led test (TLPT) ourselves.
- Penetration test your network or infrastructure. Our scope is web, API and mobile.
- Give legal advice or write your ICT risk policies.
Common questions
Does DORA apply to us?
Banks, insurers, investment firms, payment and crypto-asset providers and other EU financial entities, plus ICT providers designated as critical. Your compliance team confirms scope; we test against it.
Does DORA require penetration testing?
It requires a risk-based testing programme, and Article 25 lists penetration testing among the tests. Threat-led testing (TLPT) is a separate, advanced test for firms a supervisor identifies.
Do you run the threat-led test (TLPT)?
No. TLPT is run by threat intelligence and red-team specialists you appoint. We prepare you for it and retest what it finds.
Can you test our ICT providers?
We test your side: how your systems behave when a provider fails, slows down or leaves. We do not audit the provider's own systems.
Can you work in our environment?
Yes. We test in the environment you name, with accounts you issue, after an NDA and a data processing agreement are signed. Our ISO 27001:2022 certificate covers the management system behind that handling.
How do we start?
With a one-month trial. If you are not happy, the first two weeks are complimentary. After the first month the notice period is 30 days. Tell us what you need to evidence.
Related: security testing, disaster recovery testing, AI Security Toolkit.