Question ID: 3560 - DORA 295
Regulation Reference: (EU) 2022/2554 - Digital Operational Resilience Act (DORA)
Topic: Digital operational resilience testing (DORA)
Article: 26
Status: Rejected
Date of submission: 30 Apr 2026
Question
We are writing to you in relation to the implementation of Threat-Led Penetration Testing (TLPT), as set out in Regulation (EU) 2022/2554 and its related delegated implementing regulations. In this context, we would appreciate it if the EIOPA could clarify the following aspects:
The expected timeline for notifying the insurance undertakings required to carry out these tests, both for the current year and for 2027.
The selection criteria that are expected to be applied in practice to determine the subset of entities within the insurance sector.
EIOPA answer
This question has been rejected because the issue it deals with is already addressed in Art.26(8) of Regulation (EU) 2022/2554 (DORA) and in Commission Delegated Regulation (EU) 2025/1190 (the RTS on TLPT) adopted under Art. 26(11).