EU DORA Compliance
TThe EU Digital Operational Resilience Act (DORA) requires financial entities to test the resilience of their ICT systems. Learn how ImmuniWeb supports DORA's vulnerability assessments and penetration testing.
Einhaltung des EU-Gesetzes über digitale operative Resilienz (DORA)
What Is the EU DORA?
DORA creates a single, EU-wide framework for the digital operational resilience of financial entities. It is built on five pillars: ICT risk management, ICT-related incident reporting, digital operational resilience testing, ICT third-party risk management, and information sharing.
The testing pillar is central to application security: entities must run a resilience-testing programme that includes vulnerability assessments and penetration testing, and the most significant entities must carry out advanced Threat-Led Penetration Testing (TLPT).
See how ImmuniWeb supports DORA's resilience testing - vulnerability assessments and penetration testing of your financial applications.Request a demo· or run a free Community Edition test.
Who Must Comply with DORA?
DORA gilt im gesamten Finanzsektor der EU:
- Financial entities- banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, trading venues and more.
- Kritische IKT-Drittanbieter, die dem Finanzsektor dienen und einem Aufsichtsregime unterliegen.
- Entities of varying size - with proportionality applied to smaller entities.
Die von diesen Einrichtungen betriebenen Web-, Mobil- und API-Anwendungen fallen eindeutig in den Anwendungsbereich der DORA-Resilienztests.
Wichtige DORA-Anforderungen an die Anwendungssicherheit
DORA's digital operational resilience testing pillar drives application-security work:
- Resilience testing programme (Articles 24-25): regular testing of ICT systems, including vulnerability assessments and scans and penetration testing, with findings remediated.
- Threat-Led Penetration Testing (Articles 26-27): advanced, intelligence-led penetration testing (based on TIBER-EU) for significant entities, at least every three years.
- ICT risk management & third-party risk: : identify and protect ICT assets, including those run by providers.
DORA Resilience-Testing Requirements in Depth
Digital Operational Resilience Testing (Articles 24-25)
DORA requires a risk-based testing programme covering ICT systems and applications, including vulnerability assessments, scans and penetration testing. For internet-facing financial applications, that means regular web and mobile penetration testing and scanning, with remediation and re-testing.
Threat-Led Penetration Testing (Articles 26-27)
Significant financial entities must perform advanced Threat-Led Penetration Testing - realistic, intelligence-led attacks against live production systems, based on the TIBER-EU framework, at least every three years. Manual, expert-led penetration testing is core to meeting this requirement.
Gängige Risiken in Web- und mobilen Anwendungen, die zu beheben sind
Die Schwachstellen, die das Testprogramm von DORA in Finanzanwendungen aufdecken soll, entsprechen stark den OWASP Top 10:
- Broken Access Control —users reaching data or actions they should not.
- Cryptographic Failures — weak or missing encryption exposing sensitive data.
- Injection — SQL, command or other injection via unvalidated input.
- Insecure Design — fehlende Sicherheitskontrollen durch Design, nicht nur durch Bugs.
- Sicherheitsmiskonfiguration — Standard-, unvollständige oder unsichere Konfiguration.
- Anfällige und veraltete Komponenten — ungepatchte Bibliotheken und Frameworks.
- Identification & Authentication Failures —weak login, session or credential handling.
- Software- und Datenintegritätsfehler — nicht vertrauenswürdige Updates, unsichere CI/CD-Pipelines.
- Mängel in der Sicherheitsprotokollierung und -überwachung — Angriffe, die unentdeckt bleiben.
- Server-Side Request Forgery (SSRF) — the server tricked into making malicious requests.
Für mobile Apps ist die OWASP Mobile Top 10 die entsprechende Referenz (unsichere Datenspeicherung, unsichere Kommunikation, schwache Kryptografie usw.). Das zuverlässige Finden dieser Probleme erfordert das Testen der laufenden Anwendung, nicht nur eine Dokumentenüberprüfung.
How to Approach DORA Resilience Testing with ImmuniWeb
- 1. Map ICT assets. Inventory internet-facing financial apps and APIs with ImmuniWeb Discovery.
- 2. Führen Sie Schwachstellenanalysen (Art. 24-25) mit Neuron Scanning durch.
- 3. Penetration test web and mobile applications with On-Demand and MobileSuite.
- 4. Support TLPT (Art 26-27) with expert-led, intelligence-driven manual testing.
- 5. Remediate and retest with actionable, zero-false-positive reports.
- 6. Test continuously with Continuous in CI/CD to keep resilience current.
So hilft Ihnen ImmuniWeb bei der DORA-Compliance.
ImmuniWeb supports DORA's resilience-testing pillar with the vulnerability assessments and penetration testing the regulation requires.
| Anforderung | Was erforderlich ist | ImmuniWeb-Produkte |
|---|---|---|
| Resilience testing (Art 24-25) | Vulnerability assessments, scans and penetration testing. | On-Demand, Neuron, Continuous |
| TLPT (Art 26-27) | Fortgeschrittene, bedrohungsgetriebene Penetrationstests. | On-Demand, MobileSuite |
| ICT asset & third-party risk | Kartierung und Überwachung der externen Angriffsfläche. | Discovery (ASM / Dark Web) |
ImmuniWeb On-Demand und MobileSuite führen manuelle Web- und Mobile-Penetrationstests durch (einschließlich Unterstützung für TLPT-ähnliche Engagements); Neuron und Neuron Mobile bieten automatisiertes Scanning; Continuous integriert Tests in CI/CD; und Discovery kartiert Ihre Angriffsfläche für ICT- und Drittanbietersrisiken.
DORA vs International Frameworks
Wenn Sie bereits nach internationalen Standards arbeiten, decken dieselben ImmuniWeb-Tests alle diese Standards ab:
| Framework | Aspekt der Anwendungssicherheit | Wie ImmuniWeb abbildet |
|---|---|---|
| EU-DORA | Resilienztests: Schwachstellenanalysen, Penetrationstests, TLPT | Web/mobile pentest, scanning, ASM, TLPT support |
| EU NIS 2 | Article 21 risk-management measures | Dieselben Tests decken beide ab |
| ISO/IEC 27001 | Anhang A technische Kontrollen | Tests als Kontrollnachweis |
| PCI DSS 4.0.1 | Req 6 & Req 11 | Web app pentest + scanning |
Penetrationstests vs. Security Scanning
Beides ist erforderlich. Automatisiertes Scannen (DAST) bietet eine breite, häufige Abdeckung und ist ideal für kontinuierliche Tests im CI/CD-Pipeline; manuelle Penetrationstests finden Geschäftslogik- und komplexe Schwachstellen, die Scanner übersehen, und liefern die Tiefe, die Prüfer und Regulierungsbehörden erwarten. Kombinieren Sie kontinuierliches Scannen mit regelmäßigen manuellen Penetrationstests und führen Sie nach wesentlichen Änderungen erneut Tests durch.
Compliance-Checkliste (Anwendungssicherheit)
- Inventory of internet-facing financial apps and APIs
- Regelmäßig durchgeführte Schwachstellenanalysen und -scans (Art. 24–25)
- Penetration testing of web and mobile applications
- Threat-Led Penetration Testing for significant entities (Art 26-27)
- Findings remediated and re-tested; evidence retained
- Testing embedded in CI/CD for ongoing resilience
- Überwachung der ICT-Drittanbieter- und Angriffsflächenrisiken
Why DORA Compliance Matters
DORA is directly supervised by financial regulators, and competent authorities can impose administrative measures and penalties for non-compliance. Resilience testing is an explicit, recurring obligation - not a best-effort exercise.
Because web, mobile and API applications are a primary attack surface for financial institutions, demonstrable testing is one of the most direct ways to meet DORA's testing pillar and reduce operational risk.