DORA · DDOS RESILIENCE TESTING
DORA requires financial entities (except microenterprises) to test all ICT systems supporting critical or important functions at least annually. A documented DDoS resilience test satisfies several of the required test types at once.
DORA · REGULATION (EU) 2022/2554
ART. 24–25
DORA SCOPE
What matters is whether your company belongs to one of the categories listed in Art. 2 DORA. Unlike NIS-2, there are no general size thresholds — but the extent of the obligations follows the principle of proportionality.
Not sure if you are in scope? Ask our experts21 categories
No size threshold
In force since 17 January 2025
LEGAL BASIS
DORA nowhere says “run a DDoS test” — but a DDoS resilience test maps directly onto binding obligations.
Every financial entity must test all ICT systems supporting critical or important functions at least annually. Art. 25(1) explicitly names performance testing, end-to-end testing, scenario-based tests and network security assessments — a DDoS load and resilience test is a performance plus scenario-based test.
Capacity and performance management, network security management and ICT business continuity all point at availability protection — the justification for including DDoS in your testing scope.
The obligation is now a documented, risk-based testing programme — not just an annual pentest. Supervisors expect evidence, methodology and repeatability.
ART. 24–25
BASIC TESTING PROGRAMME
Clients frequently conflate the two. Getting it right saves budget and avoids audit findings.
DDoS resilience test
TLPT (Art. 26)
Volumetric, protocol and application-layer scenarios tailored to your exposure.
Measured breaking points and degradation behaviour of your critical systems.
A structured report that maps results to Art. 24–25 and DelReg 2024/1774.
Prioritised measures to raise your availability protection.
We identify the ICT systems supporting your critical or important functions.
Attack scenarios and load profiles matched to your risk profile.
Controlled DDoS simulation with continuous monitoring and abort criteria.
Documented results and a remediation roadmap, mapped to DORA.
If you hold a licence for one of the 21 categories under Art. 2 DORA, yes — regardless of turnover or headcount.
Not by name. But annual, risk-based tests of all ICT systems that support critical or important functions are mandatory, and a DDoS resilience test covers performance and scenario-based testing particularly cleanly.
No. TLPT (Art. 26) is threat-led penetration testing for designated entities every three years. A DDoS resilience test belongs to the basic testing programme under Art. 24–25 and applies to all financial entities except microenterprises.
At least annually for systems supporting critical or important functions, and proportionate to your risk profile.
Request your quote for a Cypurge DDoS resilience test, or start with a DORA gap assessment to see where you stand.
DORA · Art. 24–25 · DelReg (EU) 2024/1774
Thank you. A Cypurge expert will contact you shortly.
