Recital 44

Threat-Led Penetration Testing Limited to Identified Entities Unofficial title

As only those financial entities identified for the purposes of the advanced digital resilience testing should be required to conduct threat-led penetration tests, the administrative processes and financial costs entailed in the performance of such tests should be borne by a small percentage of financial entities.

https://dora.digiphile.law/recital/recital-44.html

Text as at 3 November 2026.

This is an unofficial convenience version of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.