DORA Just Set a Named-Tester Bar for Penetration Testing. Can You Prove Your Team Clears It?
October 9, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
DORA's threat-led penetration testing rules do not ask whether you ran a test. They ask you to name the individual who led it, document their years of experience, and prove their certification before the engagement starts. For any financial entity in scope, or any vendor selling penetration testing services into that market, tester credentials are no longer a resume line. They are a compliance artifact your regulator can demand to see.
What does DORA actually require of your penetration testing team?
Article 27 of the Digital Operational Resilience Act sets a specific, named-person bar for anyone running a threat-led penetration test, not a general statement about vendor quality. The regulatory technical standards finalized by the European Supervisory Authorities and adopted by the European Commission as Commission Delegated Regulation (EU) 2025/1190 entered into force on July 8, 2025, and they spell out exactly who is allowed to hold a red team engagement.
The specifics are unusually granular for a financial regulation. According to one detailed breakdown of the RTS, the external lead tester must carry at least five years of penetration testing and red team experience, backed by two additional testers with at least two years each. The same standard requires certification from an accreditation body or documented adherence to a formal ethical framework, which is exactly the language a compliance officer needs when a supervisor asks how you vetted your testing provider.
This is not a checkbox exercise, either. Under DORA, internal testers are permitted only with competent authority approval and specific conflict-of-interest safeguards, while significant credit institutions supervised under the Single Supervisory Mechanism must use external testers exclusively. Even when internal testers are allowed, the threat intelligence function producing the attack scenarios must always come from an independent external provider, and every third test cycle must use an external red team regardless of what the previous two looked like.
That structure exists because DORA applies broadly. The regulation covers roughly 20 types of financial entities and their ICT providers, and it has applied directly across the European Union since January 17, 2025. TLPT itself only reaches the largest, most systemically significant firms, but any bank, insurer, or payment company anticipating that designation now has to build a tester-vetting process well before its supervisor tells it to run one.
How do you prove your red team clears the DORA bar before a regulator asks?
You prove it the same way you would document any staff qualification control: with a named individual, a verifiable credential, and a paper trail that predates the engagement. Waiting until a supervisor requests evidence is the wrong order of operations, because sourcing a qualified provider takes months, not weeks.
The RTS builds on the TIBER-EU framework, the threat intelligence-based ethical red teaming methodology the European Central Bank developed years before DORA existed, and this matters for provider selection. CREST accreditation, recognized under both the UK's CBEST framework and TIBER-EU, functions as a qualifying standard that satisfies the certification requirement in Article 27. For an entity supervised directly by the European Central Bank, the connection is now formal rather than advisory. As of the ECB's November 2025 implementation guide, running a TIBER-EU test under the ECB's control team is how a directly supervised entity satisfies its DORA TLPT obligation outright.
Procurement teams should treat this the way they would any regulated staffing control, meaning the question is not "does the vendor have a good reputation" but "can each named tester on this engagement produce a credential and an experience record that would survive supervisory review." That distinction matters because DORA's tester bar is a personnel requirement, not a company-level one. A firm with a strong brand can still fail an engagement if the individuals assigned to it cannot document the required years and certification.
Here is what a defensible tester-qualification file typically needs to show, whether you are the financial entity or the provider being vetted:
- Named lead tester with documented years of penetration testing and red team experience, plus named supporting testers meeting their own minimum threshold
- Current certification from a recognized accreditation body, or documented adherence to a formal ethical testing framework
- A written independence attestation separating the threat intelligence provider from the red team executing the attack
- Professional indemnity coverage and a confidentiality agreement covering the live production systems under test
That last point is easy to overlook but shows up directly in the standard. Article 27 requires external testers to carry professional indemnity insurance in addition to the experience and certification thresholds, which turns tester qualification into a contractual and insurance question as much as a technical one.
Why this becomes an executive accountability issue, not just a testing decision
A missed or poorly documented TLPT cycle is not a technical failure your CISO absorbs quietly. It is a governance gap that surfaces at the board level, because DORA gives competent authorities direct visibility into who ran the test, when, and under what credentials. If your organization cannot produce that file on request, the exposure is regulatory, not just operational.
This is also why the qualified-provider market is thin. Demand for TLPT-eligible testers is concentrated among a small number of accredited firms, and the recognized accreditation routes in the sector admit a limited number of individuals and companies each year. That scarcity is pushing more security leaders to build in-house bench strength that can satisfy the experience and certification bar directly, rather than relying entirely on external procurement in a tight market.
Building the documentation trail before you need it
The practical fix is to stop treating tester qualification as a vendor management afterthought and start treating it as a staffing pipeline you own. That means identifying which of your internal red team members are close to the documented experience threshold, tracking their certification status the way you would track any regulated role, and keeping the paperwork current rather than reconstructing it under deadline pressure.
For engineers building toward that bar, EC-Council's CPENT certification is built around the same live-environment, adversary-simulation skill set the RTS describes, including multi-stage attack chains against production-like infrastructure rather than isolated lab exercises. That is a meaningfully different preparation path than a general security certification, and it maps closely to what a supervisor wants to see documented for a named tester. If your team is deciding where to start, the certification curriculum overview and FAQ walks through how the exam maps to the skills TLPT engagements actually require.
None of this is optional groundwork if your institution expects a TLPT designation in the next supervisory cycle. Sourcing, vetting, and documenting a qualified tester bench takes months, and the RTS gives you no grace period once your competent authority names you in scope. If you want a study plan built around this specific credentialing gap, you can start training now rather than after the designation letter arrives.
The broader lesson extends past DORA's borders. TIBER-EU's tester-qualification model is already influencing testing frameworks outside the European Union, including comparable intelligence-led testing regimes adopted by other national regulators. Firms that build a documented, credentialed tester bench now are not just clearing one EU regulation. They are building the accountability record that every version of this requirement, wherever it shows up next, is going to ask for.