{"id":112263,"date":"2026-09-21T12:00:00","date_gmt":"2026-09-21T12:00:00","guid":{"rendered":"https:\/\/www.red-gate.com\/simple-talk\/?p=112263"},"modified":"2026-09-08T15:54:48","modified_gmt":"2026-09-08T15:54:48","slug":"how-test-data-management-helps-meet-doras-resilience-testing-requirements","status":"publish","type":"post","link":"https:\/\/www.red-gate.com\/simple-talk\/data-security-privacy-compliance\/how-test-data-management-helps-meet-doras-resilience-testing-requirements\/","title":{"rendered":"How test data management helps meet DORA’s resilience testing requirements"},"content":{"rendered":"\n

DORA requires financial institutions to run tests that prove their systems can withstand operational disruption without<\/em> exposing sensitive data. This article explains how test data management practices can provide the realistic but safe data needed for resilience testing and the governance controls required under DORA\u2019s ICT risk management rules. <\/strong><\/p>\n\n\n\n

What is DORA?<\/h2>\n\n\n\n

For compliance,<\/a> financial organizations must perform regular resilience testing – and sometimes even advanced threat-led penetration testing (TLPT)<\/a> – of any systems supporting critical or important functions.<\/strong><\/p>\n\n\n\n

At the same time, as part of its Information and Communication Technology (ICT)<\/a> risk management and governance framework, DORA demands high standards for the availability, integrity, and confidentiality of data in every<\/em> environment – not just production. <\/p>\n\n\n\n

But what exactly is DORA?<\/strong><\/p>\n\n\n\n

\u201cThe purpose of [DORA] is to strengthen the digital operational resilience of the financial sector.\u201d<\/em> \u2014 Recital 1, DORA<\/strong> <\/p>\n\n\n\n

The Digital Operational Resilience Act<\/a> (DORA) has been in force across the EU since January 2025 and applies to any organization that works with, or provides services to, an EU-based Financial Entity (FE)<\/a>. <\/strong><\/p>\n\n\n\n

DORA is designed to strengthen the ability of financial institutions (such as banks, insurers and investment firms) to withstand operational disruption – whether caused by technology failures, data corruption, human error, or a cyber attack<\/a>. <\/p>\n\n\n\n

It also requires firms to show that, when incidents occur, they can contain the impact and return to normal operations quickly.<\/p>\n\n\n\n

Why is test data management relevant to DORA? <\/h2>\n\n\n\n

Good test data management (TDM)<\/a> practices will help organizations satisfy both<\/em> sides of DORA\u2019s mandate. Resilience tests can\u2019t run on empty databases, but they also can\u2019t use live customer data. To comply with both DORA and GDPR<\/a>, testing must use data that behaves like production data without<\/em> exposing personal or sensitive information<\/a>. <\/p>\n\n\n\n

With techniques such as static data masking<\/a>, synthetic data generation<\/a>, and subsetting<\/a>, a TDM system allows teams to run resilience tests with data that is realistic enough for meaningful results, but without expanding the attack surface or breaching DORA\u2019s data governance requirements. <\/p>\n\n\n\n

\n
\n
\n
\n

Enhance your data security with an automated masking approach<\/h3>\n
\n Data Masker automatically masks sensitive data across your estate, enabling you to deliver secure data to downstream environments in non-production databases for development and testing. <\/div>\n <\/div>\n Learn more & try for free<\/a>\n <\/div>\n <\/div>\n<\/section>\n\n\n

What does DORA require?<\/h2>\n\n\n\n

DORA, the common name for Regulation (EU) 2022\/2554<\/a>, establishes the overall digital operational<\/strong> resilience requirements for EU financial entities across more than 60 articles. Larger organizations are subject to more stringent obligations, penalties for non-compliance can reach 2% of annual turnover, and accountability can extend to individuals as well as organizations. <\/strong><\/p>\n\n\n\n

DORA also includes strict requirements for ICT risk management and testing, with Articles 5\u20139 and 24\u201327 explaining data governance and resilience testing. The subsequent Commission Delegated Regulation (EU) 2024\/1774<\/a> sets out the more detailed technical requirements for how organizations implement DORA’s ICT risk-management framework. <\/p>\n\n\n\n

To determine where TDM fits with DORA, it helps to understand which of the core parts of DORA are the ones that matter most for IT and data teams: <\/p>\n\n\n

\n