DORA · DDOS RESILIENCE TESTING
DORA requires every financial entity to test all ICT systems supporting critical or important functions at least once a year. A documented DDoS resilience test is one of the cleanest ways to satisfy several obligations at once.
DORA · REGULATION (EU) 2022/2554
ART. 24–25
DORA SCOPE
Unlike NIS-2, DORA does not key off turnover, balance sheet total or headcount. It keys off entity type under Art. 2 DORA, with 21 categories of financial entities. If you hold the corresponding licence, you are in scope — regardless of size.
Not sure if you are in scope? Ask our experts21 entity categories
Art. 2 DORA scope
In force since 17 Jan. 2025
LEGAL BASIS
DORA nowhere says “run a DDoS test” — but a DDoS resilience test maps directly onto binding obligations.
Every financial entity must test all ICT systems supporting critical or important functions at least annually. Art. 25(1) explicitly names performance testing, end-to-end testing, scenario-based tests and network security assessments — a DDoS load and resilience test is a performance plus scenario-based test.
Capacity and performance management, network security management and ICT business continuity all point at availability protection — the justification for including DDoS in your testing scope.
The obligation is now a documented, risk-based testing programme — not just an annual pentest. Supervisors expect evidence, methodology and repeatability.
ART. 24–25
BASIC TESTING PROGRAMME
Clients frequently conflate the two. Getting it right saves budget and avoids audit findings.
DDoS resilience test
TLPT (Art. 26)
Volumetric, protocol and application-layer scenarios tailored to your exposure.
Measured breaking points and degradation behaviour of your critical systems.
A structured report that maps results to Art. 24–25 and DelReg 2024/1774.
Prioritised measures to raise your availability protection.
We identify the ICT systems supporting your critical or important functions.
Attack scenarios and load profiles matched to your risk profile.
Controlled DDoS simulation with continuous monitoring and abort criteria.
Documented results and a remediation roadmap, mapped to DORA.
If you hold a licence for one of the 21 entity categories under Art. 2 DORA, yes — regardless of your turnover or headcount.
Not by name. But annual, risk-based testing of all critical ICT systems is mandatory, and a DDoS resilience test is one of the cleanest ways to cover performance and scenario-based testing.
No. TLPT (Art. 26) is threat-led penetration testing for designated entities every three years. A DDoS resilience test belongs to the basic testing programme under Art. 24–25 and applies to everyone.
At least annually for systems supporting critical or important functions, and proportionate to your risk profile.
Request your quote for a Cypurge DDoS resilience test, or start with a DORA gap assessment to see where you stand.
DORA · Art. 24–25 · DelReg (EU) 2024/1774
Thank you. A Cypurge expert will contact you shortly.
