Home » News » CREST publishes practical DORA guidance to support threat-led penetration testing
Posted by Rachel Simpson on 13 November 2026
New resources developed by CREST’s accredited TLPT community help financial institutions and cybersecurity providers navigate the requirements and delivery of DORA threat-led penetration testing.
The EU’s Digital Operational Resilience Act (DORA) places greater emphasis on how financial institutions demonstrate their ability to withstand, respond to and recover from cyber threats. For financial entities required to undertake threat-led penetration testing (TLPT), this means demonstrating the effectiveness of their security controls and operational response through realistic, intelligence-led testing.
To support organisations navigating these requirements, CREST has published a new DORA Overview, developed through a working group of CREST-accredited TLPT member companies.
The guidance draws on the practical experience of specialists delivering threat-led testing in complex and critical environments, providing a useful reference for financial institutions and the cybersecurity providers supporting them.
Under Article 26 of DORA, certain financial entities designated by their competent authorities must undertake TLPT in accordance with a methodology aligned to the TIBER-EU framework.
The objective extends beyond identifying technical vulnerabilities. Testing examines how effectively an organisation detects sophisticated threat activity, responds to incidents and coordinates decisions across technical and leadership teams.
The DORA regulatory framework: Understanding the requirements for TLPT and their relationship to TIBER-EU
Engagement phases and timelines: What to expect during preparation, threat intelligence, red teaming and closure
Roles and responsibilities: The organisations, authorities and specialist teams involved in delivering and overseeing a test
Testing approaches: How different engagement structures account for organisational complexity and third-party ICT dependencies
The DORA overview (PDF) is intended to help both financial institutions and service providers understand the TLPT process and prepare for an engagement.
Practical resources developed by practitioners
Alongside the Overview, CREST’s TLPT working group has developed three practical templates to support the delivery and reporting of DORA TLPT engagements:
Red Team Test Plan Template – Supporting the documentation of testing scenarios, objectives, rules of engagement and risk management arrangements.
Red Team Technical Report Template – Providing a structured approach to documenting testing activities, findings and recommendations.
Purple Team Report Template – Supporting the reporting of collaborative testing activities, detection capabilities and opportunities for improvement.
The templates provide a common foundation for engagement documentation while allowing providers to adapt them to the circumstances of individual tests.
They are initially being made available to CREST STAR-FS and TLPT accredited companies, with wider public availability planned through CREST’s Financial Services Hub in due course.
Together, these resources reflect CREST’s commitment to supporting consistent, credible and professionally delivered cybersecurity testing.
Finding an accredited TLPT provider
Selecting an appropriately qualified provider is an important consideration for financial institutions preparing for DORA TLPT.
CREST accreditation provides independent assurance that a provider has been assessed against recognised standards covering technical capability, processes and governance.
Financial institutions can use CREST Marketplace to identify accredited providers with relevant capabilities and experience.
For services specifically assessed for financial sector testing, buyers can filter by CREST Specialism:
TLPT-FS Threat Intelligence
TLPT-FS Threat Led Penetration Testing
CREST Marketplace also includes providers accredited in the broader disciplines of Threat Intelligence for Simulated Attack TI (formerly STAR TI) and Threat Led Penetration Testing (formerly STAR ILPT).
Buyers should check each provider’s specific accreditation and suitability for their engagement.
Further guidance
For additional background, CREST’s existing DORA TLPT whitepaper explores the regulatory requirements, the role of threat-led testing in operational resilience and the importance of selecting appropriately accredited service providers.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
