Pentest for DORA: The Scoping & Evidence Checklist (2026 Guide)

“We need a pentest for DORA” is where most teams start — and then get stuck on what, exactly, to test and what the assessor will want to see. DORA does not hand you a checklist, so this is one. It turns the regulation's testing obligations into the concrete scope, evidence, and workflow you need to pass review without a scramble.

This is the practical companion to the requirements: what to scope, what to keep, why first attempts fail, and how to keep the whole thing current instead of re-doing it from scratch every cycle.

DORA anchors on critical and important functions — the business capabilities whose failure would materially harm your operations, your customers, or market stability. Start there. For each function, map every ICT system that supports it: the customer-facing app, the internal APIs and admin tooling behind it, the infrastructure it runs on, the identities that can reach it, and the third parties woven through it.

Then test that map from two directions and at two layers: the external internet-facing surface and the internal surface behind your firewall, at both the network and application layers. Skip a quadrant and you have scoped a demo, not a DORA test.

An assessor is not grading vibes; they open a folder. Make sure it contains all five parts. (1) Scope and methodology, signed off, showing the function-to-system map. (2) Findings with real proof — working exploit evidence, not just a scanner's ‘possible’ flag. (3) Re-test results proving each exploitable issue was fixed, with before-and-after. (4) Tester independence — evidence the tester is separated from the systems under test. (5) A dated remediation log with owners and closure dates.

Three failure modes account for most rejected first attempts. Incomplete scope: the public website was tested but the internal APIs, admin panels, and the controls that isolate sensitive systems were not. No re-test: findings were reported but never proven fixed — DORA wants the loop closed, not just opened. Stale coverage: the test was accurate on the day it ran, but the environment moved and nobody re-tested after the change, so ‘after significant change’ quietly went unmet.

The fix for all three is the same shape: broaden the scope to the full map, always close the re-test loop, and make testing continuous rather than annual.

The version of this checklist that actually survives contact with a growing environment is the one that re-runs itself. If your testing fires after every deploy, the evidence folder is never more than a day old, the ‘after significant change’ obligation is met by default, and the re-test loop closes automatically the next time the scan runs.

Pentestas is pentesting as a service built for exactly this checklist: an AI penetration testing system that re-runs internal and external tests continuously so the evidence folder is always current. Under the hood it is penetration testing with AI — penetration testing with Claude for deep reasoning on chained flaws and penetration testing with DeepSeek for broad, cheap coverage — delivered as a B2B SaaS pentest platform that hands your assessor a clean, mapped report instead of a stale PDF.

Bottom line: a pentest for DORA is not one PDF a year — it is a full-scope test of every system behind your critical functions, backed by a five-part evidence folder and a closed re-test loop. Keep it continuous and the checklist stays green on its own, at a fraction of the cost of redoing it each cycle.