DORA Resilience Testing: Chaos Engineering and TLPT for Financial Infrastructure

DORA Article 24 requires financial entities to maintain a "comprehensive digital operational resilience testing programme." For significant institutions, Article 26 mandates threat-led penetration testing (TLPT) at least every three years. This isn't a penetration test — it's a full-spectrum attack simulation against production systems.

The Testing Spectrum

• Basic testing (all entities) — Vulnerability scanning, network security assessments, gap analyses, software security reviews, source code analysis, scenario-based testing, compatibility testing, performance testing
• Advanced testing (significant entities) — Threat-led penetration testing based on TIBER-EU framework, red team exercises against live production, purple team exercises combining red and blue teams

Chaos Engineering for DORA

Chaos engineering provides the continuous resilience testing DORA requires between TLPT cycles:

• Infrastructure chaos — Randomly terminate instances, degrade networks, corrupt storage. Does the system self-heal? (Litmus, Chaos Mesh, Gremlin)
• Application chaos — Inject latency, errors, and resource exhaustion into services. Do circuit breakers and fallbacks work?
• Dependency chaos — Simulate third-party service outages. Does your infrastructure handle provider failures gracefully?
• Data plane chaos — Test database failover, replication lag, and backup restoration under realistic conditions

TLPT Infrastructure Requirements

TLPT under TIBER-EU requires:

• Threat intelligence phase — infrastructure to collect and analyze threat data specific to your institution
• Red team phase — isolated command-and-control infrastructure, attack tooling, operational security
• Blue team integration — detection and response monitoring without foreknowledge
• Evidence collection — comprehensive logging of attack paths, detection times, response actions
• Remediation tracking — infrastructure to track and verify fixes for identified weaknesses

Game Days

Run quarterly "game days" — scheduled chaos engineering exercises that test specific DORA scenarios: complete cloud region failure, critical third-party outage, ransomware simulation, insider threat scenario. Measure recovery time, data loss, and communication effectiveness. Document everything — this is your DORA evidence.