01. NIS2 vs. DORA: Comparative Matrix
While both laws enforce operational resilience across the European Single Market, they differ in sector application, testing cadences, and enforcement mechanisms:
| Feature | NIS2 Directive (EU 2022/2555) | DORA Regulation (EU 2022/2554) |
|---|---|---|
| Applicable Scope | 18 critical sectors (energy, transport, health, digital providers, public admin, manufacturing) | Financial entities (banks, insurers, investment funds, crypto-asset firms, payment gateways) |
| Legal Enforcement | National transposition laws across all 27 EU Member States | Directly applicable EU regulation across all Member States |
| Standard Testing Cadence | Regular risk-calibrated assessments; pre-release tests for digital providers | At least yearly for all systems supporting critical functions |
| Advanced Red Teaming | Discretionary based on national supervisory guidelines | Mandatory Threat-Led Penetration Testing (TLPT) at least every 3 years |
| Maximum Fine Penalties | Up to €10M or 2% of global turnover (essential entities) | Periodic penalty payments up to 1% of average daily global turnover |
02. NIS2 Article 21 & Implementing Regulation (EU) 2024/2690
Article 21 mandates essential and important entities to take appropriate and proportionate technical and organizational measures to manage cybersecurity risk:
Vulnerability Handling & Effectiveness Assessments
Entities must establish structured vulnerability disclosure and remediation processes, backed by formal policies and procedures to regularly assess the effectiveness of their cybersecurity risk-management measures.
Explicit Mandate for Cloud & Managed Service Providers
For cloud computing providers, data centers, managed service providers (MSPs), managed security service providers (MSSPs), and online marketplaces, Point 6.5 of the annex mandates a documented security testing policy that explicitly includes penetration testing and dynamic application security testing (DAST) at system setup, after significant upgrades, and following major maintenance.
03. DORA Articles 24–25: Yearly Operational Resilience Testing
Under DORA Chapter IV, financial entities (except microenterprises) must maintain a comprehensive, documented digital operational resilience testing program as an integral part of their ICT risk management:
Yearly Mandatory Cadence (Article 24(6))
Financial entities must ensure that appropriate tests are conducted at least yearly on all ICT systems and applications supporting critical or important functions.
Prescribed Testing Methodologies (Article 25)
The testing program must encompass vulnerability assessments and scans, open source analyses, network security reviews, gap analyses, physical security reviews, source code reviews, scenario-based tests, and penetration tests.
Functional Independence & Conflict Elimination (Article 24(4))
Tests must be conducted by independent parties (internal or external) who have no operational responsibility for the systems under evaluation.
04. DORA Articles 26–27 & TLPT Regulation (EU) 2025/1190
For systemically important financial entities, DORA mandates advanced adversary emulation under the TIBER-EU framework:
Production Red Teaming Every 3 Years
Financial entities identified by supervisory authorities (ECB, EBA, ESMA, EIOPA) must carry out advanced TLPT at least once every three years. Crucially, testing must be performed on live production environments covering critical business processes, transaction settlement engines, and core banking portals.
Delegated Regulation (EU) 2025/1190 establishes rigorous standards for testers: certified threat intelligence teams, ethical hacking credentials, verifiable red team track records, and mandatory professional indemnity insurance.
05. ICT Third-Party Service Provider Obligations
Both NIS2 and DORA eliminate the concept of outsourced liability. Third-party cloud hosts, payment processors, and SaaS providers are directly integrated into testing mandates:
NIS2 Supply Chain Security (Art 21(2)(d))
Essential entities must evaluate the cybersecurity practices and technical testing maturity of their direct ICT suppliers during procurement and contract renewals.
DORA Multi-Party TLPT (Art 26(4))
When a financial entity's critical function is delivered by a third-party ICT service provider, the provider must actively participate in the financial entity's TLPT simulation.
06. Building an EU Operational Resilience Testing Lifecycle
Critical Function Mapping
Catalog all core banking systems, digital payment APIs, and essential infrastructure services subject to yearly DORA/NIS2 testing.
Automated Pre-Release Retesting
Conduct autonomous dynamic penetration tests prior to deploying application upgrades, fulfilling Implementing Regulation 2024/2690 rules.
Interim Baseline Validation
Run continuous penetration tests across production web portals between triennial TLPT exercises to ensure vulnerabilities are caught and remediated in real time.
Auditor & Supervisory Dossiers
Generate comprehensive technical evidence dossiers and Letters of Attestation detailing verified exploit fixes for competent authorities.
07. How Infiltra Supports NIS2 & DORA Compliance
Yearly & On-Demand Testing
Fulfill DORA Article 24 annual testing requirements and NIS2 pre-deployment mandates with autonomous penetration tests executed across web apps and APIs.
Strict European Data Residency
All test execution, payload orchestration, and vulnerability evidence remain strictly confined to European data centers, satisfying NIS2 and DORA digital sovereignty rules.
Eliminate False Positives
Infiltra provides deterministic proof-of-exploit traces for every finding, ensuring engineering teams can remediate genuine risks without wasting time triaging noise.
1-Click Delta Remediation Proof
When developers patch a vulnerability, trigger an automated delta retest to provide auditors with verified technical confirmation of issue closure.
08. Frequently Asked Questions
Key answers on EU NIS2 and DORA security testing mandates, TLPT requirements, and supply chain scope.
NIS2 Mandate
Does NIS2 Require Penetration Testing?
Does NIS2 Require Penetration Testing?
NIS2 Article 21 requires policies and procedures to regularly assess the effectiveness of cybersecurity risk-management measures. For digital providers such as cloud computing platforms, data centers, and managed service providers, Commission Implementing Regulation (EU) 2024/2690 explicitly mandates documented security testing policies, citing penetration testing and dynamic application security testing.
DORA Resilience
How Often Does DORA Require Operational Resilience Testing?
How Often Does DORA Require Operational Resilience Testing?
Under Article 24, financial entities must conduct appropriate security testing at least yearly on all ICT systems supporting critical or important functions. In addition, institutions designated as significant by European authorities must undergo advanced Threat-Led Penetration Testing (TLPT) at least every three years.
Tester Qualifications
Who Is Eligible to Perform DORA Resilience Tests?
Who Is Eligible to Perform DORA Resilience Tests?
Annual operational testing can be conducted by independent internal testers or third-party firms, provided that conflicts of interest are eliminated. TLPT testers must meet heightened criteria under Article 27 and Delegated Regulation (EU) 2025/1190, requiring accredited threat intelligence credentials, ethical hacking certifications, and significant professional indemnity insurance.
ICT Supply Chain
Do DORA Testing Requirements Apply to SaaS and Cloud Suppliers?
Do DORA Testing Requirements Apply to SaaS and Cloud Suppliers?
Yes. Third-party ICT service providers that support critical financial functions are legally subject to inclusion in client resilience testing and TLPT exercises. Critical ICT providers are furthermore subject to direct oversight by the European Supervisory Authorities (ESAs).