As the compliance deadline for the EU's Digital Operational Resilience Act (DORA) approaches in January 2025, financial institutions and their ICT providers must prepare to meet the regulation’s stringent Threat-Led Penetration Testing (TLPT) requirements.

We provide an in-depth overview of DORA’s TLPT framework, offering practical guidance on how to integrate offensive security services to meet regulatory demands and ensure resilience against cyber threats through penetration testing.

Attendees will gain a clear roadmap for achieving DORA compliance through a strategic approach to testing, threat intelligence, and vulnerability remediation.

Key Takeaways:

Detailed breakdown of DORA’s TLPT requirements and their implications financial services and ICT providers
How to design and implement a compliant TLPT framework that enhances organizational resilience
Key offensive security services that organizations should seek to fulfill DORA requirements
Best practices for selecting external testers and aligning testing processes with regulatory standards

Lesson Learned from the session

Understanding DORA and Its Importance

DORA is a Law, Not a Guideline – It establishes strict cyber resilience requirements for financial entities and their ICT service providers operating in the EU.
The Growing Cyber Threat Landscape – Financial institutions are highly interconnected, creating systemic cyber risks.
Recent Supply Chain Attacks & Ransomware Evolution – Events like the SolarWinds attack and sophisticated ransomware groups (LockBit, BlackCat, Black Basta) highlight the urgent need for improved security measures.

Who Must Comply with DORA?

Banks, credit institutions, insurance companies, trading firms, investment funds, pension funds
Crypto-asset service providers, exchanges, and other financial entities
ICT third-party service providers (e.g., cloud providers, core banking software vendors

Key Deadlines

January 2023 – DORA came into force
January 17, 2025 – Deadline for financial institutions to be fully DORA-compliant

Core Pillars of DORA Compliance

ICT Risk Management – Institutions must create robust risk frameworks to anticipate and mitigate cyber threats.
Third-Party Risk Management – Institutions must vet and monitor external service providers for security risks.
Digital Operational Resilience Testing (DORT) – Requires vulnerability assessments, penetration testing, and TLPT.
Incident Reporting – Organizations must have monitoring and reporting procedures for cyber incidents.
Threat-Led Penetration Testing (TLPT) – The most advanced form of resilience testing, requiring real-world attack simulations.

What is TLPT and How is it Different?

More Than a Standard Penetration Test – TLPT is a goal-oriented, adversary emulation approach similar to red teaming.
Testing Must Be Based on Real-World Threats – Organizations must use threat intelligence to mimic actual attackers, such as ransomware groups or APT actors.
Annual Security Testing Required – Every three years, an external third party must conduct TLPT. Internal teams may conduct up to two of the three required tests.

Implementing TLPT - Various Approaches:

Red Teaming: Simulating a full-scale cyberattack against an organization’s critical systems to test defensive capabilities.
Purple Teaming: A collaborative approach where red teams and blue teams work together to improve detection and response.
Strategic Threat Intelligence: Attack scenarios should mirror real-world adversary tactics, using frameworks like MITRE ATT&CK.

Third-Party Risk & Exit Strategies

Organizations must maintain a third-party risk register and classify vendors based on risk levels.
Exit Strategies Are Mandatory – Organizations must have a backup plan in case a critical vendor is breached or unavailable.
Contractual Clauses Matter – DORA mandates that vendor contracts include security requirements and termination clauses for non-compliance.

DORA Compliance: Practical Next Steps

Conduct a Gap Analysis – Identify where your organization is non-compliant and develop a roadmap.
Create a Risk Register – Document all third-party vendors and evaluate their security postures.
Develop a TLPT Plan – Align testing programs with real-world threat intelligence and red teaming.
Ensure Executive Buy-in – Senior management is responsible for overseeing compliance efforts.
Leverage External Expertise – Work with accredited TLPT providers like Bishop Fox to meet DORA’s rigorous testing requirements.

Final Thoughts from the Experts

DORA presents a huge opportunity – Compliance isn’t just a legal necessity; it’s a chance to improve overall cybersecurity.
“You get what you put into this.” – Organizations should embrace TLPT as a valuable security practice rather than just a compliance checkbox.
Third-Party Testing is Key – External testing ensures independence, credibility, and regulatory approval.