{"id":157689,"date":"2024-07-23T15:09:09","date_gmt":"2024-07-23T13:09:09","guid":{"rendered":"https:\/\/www.fma.gv.at\/?page_id=157689"},"modified":"2025-09-22T11:31:59","modified_gmt":"2025-09-22T09:31:59","slug":"dora-digital-operational-resilience-testing","status":"publish","type":"page","link":"https:\/\/www.fma.gv.at\/en\/cross-sectoral-topics\/dora\/dora-digital-operational-resilience-testing\/","title":{"rendered":"DORA – Digital operational resilience testing"},"content":{"rendered":"
\"\"<\/span>
\n

Digital operational resilience testing<\/strong><\/p>\n<\/div><\/div>

<\/div>

The requirements regarding digital operational resilience tests cover the general testing programme that all financial entities are required to observe and the threat-led penetration testing (TLPT) required to be conducted on live production systems, that only relate to financial entities that only meet individual prescribed criteria.<\/p>

General testing programme<\/h2>

Financial entities draw up comprehensive programmes for testing their digital operational resilience, for example containing vulnerability assessments and scans, gap analyses, source code reviews, scenario-based tests or penetration tests.<\/p>

The tests are conducted by independent internal or external parties. In the case of an internal test being conducted sufficient resources are to be made available, and it must be ensured that no conflicts of interest arise of the duration of the entire test.<\/p>

All identified weaknesses are prioritised, classified and remedied. <\/p>

Appropriate tests are conducted on all ICT systems and applications supporting critical or important functions at least yearly.<\/p>

Threat-Led Penetration Testing<\/h2>

Significant financial entities are required to conduct threat-led penetration tests. Such tests – including those conducted in a production environment focus on the entity’s core IT systems. <\/p>

The specific methodology to be applied for such tests under DORA is based on the TIBER-EU framework. TIBER stands for “Threat Intelligence-Based Ethical Red Teaming” and is being implemented in Austria by TIBER-AT<\/a>.<\/p>

Information about ICT tests pursuant to Article 25 (1) DORA<\/h2>

Under Article 25 (1) DORA, financial entities are expected to conduct various types of tests (e. g. vulnerability assessments and scans, network security assessments, source code reviews, performance testing, end-to-end testing and penetration testing).<\/p>

Such tests apply for all financial entities falling in the scope of DORA, although the depth and frequency of such tests depends on the entity’s size and complexity, their general risk profile, the criticality of the ICT systems in questions, usage of outsourcing or cloud services, material changes to the ICT infrastructure as well as the remediation of incidents (risk-based approach, see Article 4 (2) DORA).<\/p>

Recognised Standards and Accreditation<\/h3>

DORA does not refer to specific standards or frameworks. The FMA is therefore unable to make specific recommendations for implementation based on a specific standard.<\/p>

Requirements regarding testers are defined in Article 24 (4) DORA in particular. There is no Austria-specific DORA accreditation for testers for testing pursuant to Article 25 DORA.<\/p>

Frequency of Testing<\/h3>

The corresponding requirements in DORA include:<\/p>