European regulatory context
Penetration Testing under NIS2 and DORA
A practical guide to EU cybersecurity risk management, digital operational resilience testing, and threat led penetration testing expectations.
Evidence of resilience, not a compliance guarantee
Organisations across Europe and the USA depend on connected systems and suppliers. Authorised penetration testing validates selected attack paths and provides evidence to prioritise remediation. EU obligations depend on the entity, sector, and applicable law. US organisations should assess whether their EU activities or relationships bring relevant requirements into scope.
NIS2: risk management and effectiveness testing
Directive (EU) 2022/2555, Article 21, requires essential and important entities to adopt appropriate and proportionate cybersecurity risk management measures. Article 21(2)(f) includes policies and procedures to assess their effectiveness. Penetration testing can support that assessment, but the directive does not prescribe a universal annual penetration test. Scope and frequency depend on risk, applicable national implementing law, and sector requirements. Article 20 addresses management body approval and oversight.
EUR-Lex, NIS2 Articles 20 and 21DORA: a proportionate testing programme
Regulation (EU) 2022/2554 applies from 17 January 2025. Articles 24 and 25 set out digital operational resilience testing requirements, subject to the regulation's scope and exemptions. Financial entities other than microenterprises must ensure appropriate tests are conducted at least yearly on all ICT systems and applications supporting critical or important functions. The programme uses a range of techniques; this is not a blanket requirement for an annual full penetration test of every system.
EUR-Lex, DORA Articles 24 and 25DORA: advanced threat led penetration testing
Article 26 requires financial entities identified by competent authorities under its criteria, including relevant significant financial entities, to undertake threat led penetration testing (TLPT) at least every three years. Authorities may adjust that frequency based on risk and operational circumstances. TLPT covers several or all critical or important functions and runs on live production systems. It requires controlled scope, risk safeguards, remediation, and supervisory engagement. It is not required of every financial entity. Article 27 sets requirements for testers; an ordinary penetration test is not automatically a qualifying TLPT exercise.
EUR-Lex, DORA Articles 26 and 27Define scope, safeguards, and reporting
Agree written authorisation, systems, critical functions, supplier permissions, testing windows, escalation contacts, and stop conditions before testing. Reports should record evidence, limitations, business impact, remediation priorities, and retest results. Retain these records within the wider risk management programme.
This guide is general information, not legal advice or a claim of regulatory approval. Confirm national NIS2 implementation, DORA applicability, and supervisory expectations with your compliance team or legal adviser. A test report is not a certification of compliance.
Discuss an assessment