--- title: "Article 25 — Testing of ICT tools and systems" type: regulation legal_status: in_force source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2554" shortTitle: "Article 25 — Testing of ICT tools and systems" instrument_type: level1_regulation authority: Commission binding: true binding_character: binding mica_level2: false legal_basis: "Regulation (EU) 2022/2554" instrument: dora celex: "32022R2554" regulation: DORA regulation-full: "Regulation (EU) 2022/2554" article: 25 status: in_force text_version: "Regulation (EU) 2022/2554, OJ L 333, 27.12.2022" source_url: "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng" check_status: matched verified: true last_checked: 2026-11-09 --- *In force · Regulation (EU) 2022/2554, OJ L 333, 27.12.2022 · Verified 9 Nov 2026 · [Official source](https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng)* 1. The [digital operational resilience](https://www.headlesslaw.com/definitions/dora/digital-operational-resilience) testing programme referred to in [Article 24](24.md) shall provide, in accordance with the criteria set out in [Article 4(2)](4.md), for the execution of appropriate tests, such as [vulnerability](https://www.headlesslaw.com/definitions/dora/vulnerability) assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing. 2. [Central securities depositories](https://www.headlesslaw.com/definitions/dora/central-securities-depository) and [central counterparties](https://www.headlesslaw.com/definitions/dora/central-counterparty) shall perform [vulnerability](https://www.headlesslaw.com/definitions/dora/vulnerability) assessments before any deployment or redeployment of new or existing applications and infrastructure components, and [ICT services](https://www.headlesslaw.com/definitions/dora/ict-services) supporting [critical or important functions](https://www.headlesslaw.com/definitions/dora/critical-or-important-function) of the financial entity. 3. [Microenterprises](https://www.headlesslaw.com/definitions/dora/microenterprise) shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of [information assets](https://www.headlesslaw.com/definitions/dora/information-asset) and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks, on the other hand. *** [Chapter IV — Digital operational resilience testing](../chapters/iv.md) · [← Article 24](24.md) · [Article 26 →](26.md)