DORA Regulation: How A42 can help with compliance

DORA (the Digital Operational Resilience Act) is a European Union regulation that sets common and mandatory rules for cybersecurity and digital resilience in the financial sector. Its goal is to make EU financial companies more resilient and to reduce risks across the whole financial value chain. The main idea is not just protecting against cyberattacks, but building cyber resilience: the ability to withstand serious cyber incidents, adapt to them and get back to work quickly. The regulation came into force on 16 January 2023 and began enforcing compliance on 17 January 2025.

DORA has extraterritorial reach and applies to any company that operates in the EU financial market or provides critical services to it. This covers around 20 types of financial entities (banks, insurance and investment firms, crypto-asset service providers, trading venues and others) and their ICT service providers: cloud providers, software developers and more.

For financial entities, DORA does not set a single fixed penalty: each EU country defines its own sanctions, which can include large fines and personal liability for executives. For critical third-party ICT providers, the regulation sets a specific penalty — a periodic fine of up to 1% of average daily worldwide turnover for each day of non-compliance, for up to six months.

Yes. If your company provides cloud services, software development, IT outsourcing or other ICT services to clients in the EU, DORA applies to you as an ICT provider, even if you are based outside the EU. In practice this means reviewing contracts with your European clients, bringing your security processes into line with the requirements, and being ready for an audit on their side.

It is regular testing that checks whether your ICT systems can withstand real attacks and failures, so weaknesses are found and fixed before attackers use them. DORA expects a risk-based approach: test first the systems that support critical or important functions. Testing ranges from vulnerability assessments, network and code security checks and penetration tests (the basic level, at least once a year for everyone) to threat-led penetration testing, TLPT (at least every 3 years for systemically important organisations).

Yes, DORA names penetration testing among the mandatory tools. The basic level requires vulnerability assessments and penetration tests for all systems that support critical functions, at least once a year. The regulation does not fix a specific number of scenarios; it speaks about the approach, coverage and regularity.

Basic testing of critical systems is required at least once a year, and for systemically important organisations also before deploying new or updated applications. Advanced TLPT testing is carried out at least once every three years. Between tests, it is advisable to maintain continuous monitoring so that new vulnerabilities do not go unnoticed.

The vulnerabilities found must be classified and prioritised by risk level, the report must contain enough information to fix them, and the client must be able to verify that a vulnerability has actually been remediated. In other words, what matters is not only the finding but the confirmed fix.

Yes. A42's AI Pentest meets DORA's requirements for testing processes and reports: every vulnerability is classified, prioritised and confirmed with a proof of concept, and the report is suitable for passing compliance. It covers the basic level of testing well and works both for annual checks and for regular scans before releases.

The cost depends on the scale of your perimeter. AI Pentest is significantly cheaper than manual testing because AI agents do most of the work, and a basic pentest starts at $1,000 (roughly €900). The exact figure is best calculated in a short consultation.