Recital 59

Choice of Critical or Important Functions within the Scope of a TLPT Unofficial title

Since this Regulation does not require financial entities to cover all critical or important functions in one single threat-led penetration test, financial entities should be free to determine which and how many critical or important functions should be included in the scope of such a test.

https://dora.digiphile.law/recital/recital-59.html

Text as at 2 November 2026.

This is an unofficial convenience version of the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in November 2026.