Applies if you have EU exposureDORA is EU regulation. This page is for firms with an EU branch or subsidiary, or that serve EU financial entities. Purely domestic US programs should start with PCI DSS, NYDFS, and the GLBA Safeguards Rule.

Compliance · DORA

DORA expects resilience you can prove.
Continuously, not once.

The EU Digital Operational Resilience Act sets ICT risk, resilience, and threat-led testing expectations for financial entities and their critical ICT providers. If DORA reaches your business, SpartanX is The Ultimate Adversary™ that keeps proving your resilience between formal tests. It supports your program and complements the mandated assessment; it does not make you compliant on its own.

Request a guided proof-of-value Explore compliance

The requirement

ICT resilience, and threat-led penetration testing for identified entities.

DORA requires financial entities to manage ICT risk and test their operational resilience. For the entities their competent authority identifies as in scope, it also requires Threat-Led Penetration Testing (TLPT) at least every three years, and the authority can adjust that frequency based on the entity’s risk profile. Between those formal tests, entities are expected to test and monitor resilience on an ongoing basis.The mechanics are set by DORA Article 26 and the Commission Delegated Regulation on threat-led penetration testing, which has applied since July 2025 and is aligned with the TIBER-EU framework. Entities may use internal testers where they meet the conditions in the technical standard, but must engage external testers for every third test, and the threat intelligence provider must be external in all cases. Significant credit institutions must always use external testers.A TLPT must cover several or all of an entity’s critical or important functions, and must be performed on live production systems supporting those functions.A TLPT closes by submitting a summary of findings, the remediation plans, and documentation showing the test was run to standard. The authority then issues an attestation, which is what allows other competent authorities to recognize the test.

Scope

EU financial entities, and firms with EU exposure.

DORA applies to a broad set of EU financial entities and their critical ICT third-party providers. Providers designated as critical must establish an EU subsidiary; the European Supervisory Authorities published the first designation list in November 2025, naming 19 firms including the major cloud platforms.For a US firm, DORA typically reaches you through an EU branch or subsidiary, or by serving EU financial entities. If none of that applies, the US mandates on the compliance hub are your starting point.

How it supports your program

The continuous engine around your formal test.

Continuous resilience testing

Between the multi-year TLPT, SpartanX keeps testing and proving resilience, so posture stays current, not frozen at the last formal test.

External and internal

It tests your external surface, and through NodeX runs the same adversary inside the perimeter. Learn about NodeX.

Complements the mandated assessment

For the formal TLPT, identified entities run the test under their competent authority, with external threat intelligence and, on the required cadence, external testers. SpartanX is the continuous engine and evidence layer around that requirement, not a replacement for the mandated assessors.

Exploit-validated findings and retest

Proof with every finding, fixed and re-attacked to confirm closure.

Audit-ready evidence

Continuous, dated reporting to support your resilience program and regulator engagement.

The outcome

Resilience you can show, all year, not just at the test.

If DORA reaches your business, you get continuous, exploit-validated testing inside and out, and a live evidence trail that supports your program and complements the formal TLPT.

Turn a continuous adversary into DORA-ready evidence.

See how SpartanX supports your resilience program between formal threat-led tests.