ContinueOps logo
    EU Regulation 2022/2554

    Updated: 21 January 2025

    Resilience,
    Proven™

    Digital Operational Resilience Act (DORA) Compliance Guide

    DORA establishes a unified regulatory framework for digital operational resilience across the European Union financial sector. The regulation has been applicable since 17 January 2025.

    The regulation applies to credit institutions, investment firms, payment institutions, insurance undertakings, crypto-asset service providers, and critical ICT third-party service providers operating within the EU.

    Business Continuity and Resilience Testing Requirements

    The following articles establish core requirements for business continuity planning and operational resilience testing. These represent areas where ContinueOps provides tooling to support compliance efforts.

    Article 11: Response and Recovery

    Full text

    Establishes requirements for ICT business continuity policy, response plans, and recovery procedures. Financial entities must implement comprehensive business continuity plans subject to regular testing.

    Key Requirements

    • Maintain ICT business continuity policy integrated with overall operational continuity
    • Implement documented response and recovery plans for ICT-related incidents
    • Conduct Business Impact Analysis (BIA) to assess exposure to severe disruptions
    • Test ICT business continuity plans at least annually, including cyber-attack scenarios
    • Maintain records of activities before, during, and after disruption events

    Article 26: Advanced Testing Based on Threat-Led Penetration Testing

    Full text

    Defines requirements for threat-led penetration testing (TLPT) of critical systems. Applicable entities must conduct TLPT at least every three years on live production systems, with qualified testers.

    Key Requirements

    Article 27: Requirements for TLPT Testers

    Full text

    Specifies qualification and operational requirements for testers conducting threat-led penetration tests, ensuring testing quality and appropriate risk management.

    Key Requirements

    • Testers must demonstrate highest suitability, reputability, and technical capability
    • Required expertise in threat intelligence, penetration testing, and red team operations
    • Certification from accredited bodies or adherence to formal ethical frameworks
    • Independent assurance on risk management during test execution
    • Professional indemnity insurance covering misconduct and negligence

    Related DORA Requirements

    Additional articles relevant to operational resilience and ICT risk management.

    Regulatory Resources

    Official publications and guidance from European supervisory authorities.

    How ContinueOps Supports DORA Compliance

    ContinueOps provides tooling specifically designed to address Article 11, Article 26, and Article 27 requirements for business continuity and resilience testing.

    Business Continuity Management

    Structured frameworks for documenting ICT business continuity policies, response plans, and recovery procedures. Includes Business Impact Analysis tooling and automated testing schedule management.

    Evidence Collection and Audit Trail

    Comprehensive logging of activities before, during, and after disruption events. Audit-ready documentation for regulatory examinations and third-party assessments.

    Testing Programme Management

    Track penetration testing schedules, manage third-party tester qualifications, and maintain attestation records for TLPT exercises.

    Request a DORA Readiness Assessment

    Understand your organisation's current position against DORA requirements. Our specialists will evaluate your ICT risk management, business continuity, and resilience testing capabilities.

    By submitting this form, you agree to be contacted by ContinueOps regarding your enquiry.