Chapter 3: What is it?

Chapter 3 of DORA focuses on the digital operational resilience testing of ICT (Information and Communication Technology) systems, tools, and processes within financial entities. This chapter mandates that financial entities within the EU or operating within the EU, including banks, investment firms, insurance companies, and other financial market infrastructures, rigorously test their ICT systems to identify vulnerabilities and mitigate potential risks.

Key sections of Chapter 3 include:

1. Regular Testing Requirements: Businesses must carry out regular, comprehensive testing of their ICT systems. This includes vulnerability assessments, penetration testing, scenario-based testing, and more.
2. Advanced Testing for Critical Functions: For critical functions and high-risk areas, more sophisticated testing techniques are required, such as threat-led penetration testing (TLPT). This involves simulating cyber-attacks to evaluate the resilience of ICT systems against sophisticated threats.
3. Third-Party Testing: Businesses are encouraged to involve independent third-party testers to ensure objectivity and thoroughness in the testing process. These testers must have no conflicts of interest to maintain the integrity of the testing outcomes.
4. Reporting and Remediation: After testing, businesses must document findings, report significant vulnerabilities, and outline remediation plans. This ensures transparency and facilitates continuous improvement in ICT resilience.

Practical Implications of Chapter 3

Implementing the requirements of Chapter 3 has profound practical implications for financial businesses. The emphasis on rigorous testing and continuous monitoring may well necessitate a strategic overhaul in how organisations approach their ICT infrastructure.

1. Resource Allocation: Organisations must allocate adequate resources, including skilled personnel and financial investments, to conduct the required testing. This may involve hiring cyber security experts or engaging with third-party testing firms.
2. Integration with Existing Frameworks: Businesses must integrate DORA’s testing requirements with existing risk management and cyber security frameworks. This means aligning DORA mandates with frameworks like ISO/IEC 27001 or NIST Cyber Security Framework to ensure comprehensive coverage.
3. Enhanced Cyber Security Posture: Regular and advanced testing helps organisations uncover hidden vulnerabilities and strengthen their cyber security posture. By addressing these vulnerabilities proactively, financial entities can mitigate the risk of cyber incidents that could disrupt operations or compromise sensitive data.
4. Regulatory Compliance: Adhering to DORA’s testing requirements is not merely a regulatory obligation but also a competitive advantage. Organisations that demonstrate robust digital operational resilience can build trust with stakeholders, including clients, regulators, and partners.

Ensuring Compliance with Chapter 3

To ensure compliance with Chapter 3 of DORA, financial entities must adopt a proactive and structured approach.

Martin Tully  – CRMG Delivery Lead Governance & Compliance Consultant highlights below his key tips to help businesses navigate this chapter effectively:

1. Develop a Comprehensive Testing Strategy: Create a detailed testing strategy that outlines the scope, frequency, and methods of testing for different ICT components. This strategy should prioritise critical functions and high-risk areas.
2. Engage Qualified Experts: Whether conducting internal testing or involving third-party testers, ensure that the individuals or firms engaged possess the necessary expertise and certifications in cyber security and digital resilience.
3. Establish Continuous Monitoring and Improvement: A continuous monitoring mechanism will help to keep track of emerging threats and vulnerabilities. Regularly update testing procedures and remediation plans based on the latest threat intelligence and industry best practices.
4. Maintain Documentation and Reporting: Thorough documentation of all testing activities, findings, and remediation efforts is crucial for regulatory reporting and demonstrates a commitment to transparency and continuous improvement.

Organisations are experiencing these challenges differently, depending on their size, sector, regulatory exposure, and risk appetite. Likewise, practitioners across cyber security, risk, assurance, and governance bring different lenses to the same evolving problem set.

To explore what this means in practice, we asked members of the CRMG team to share their perspectives on where organisations are struggling today and what they should be considering as cyber risk continues to scale through 2026.

From the operationalisation of frameworks to measuring maturity, the professionalisation of cyber roles, third-party risk management and the emerging role of AI assurance, these viewpoints are not intended to present a single definitive roadmap. Instead, they reflect the real-world tensions, trade-offs, and questions organisations are already grappling with.

A Sector Under Siege: The M&S Breach

In April 2025, Marks & Spencer became the latest UK retailer to suffer a major ransomware attack. What began as a compromise via a third-party help desk escalated into operational paralysis: online orders failed, loyalty cards stopped working, contactless payments collapsed, and frontline staff reverted to pen and paper. For a business of M&S’s scale and heritage, this wasn’t just a technical failure – it was a commercial crisis.

The numbers are staggering: £300 million in lost sales, nearly £1 billion wiped from its market value, and significant reputational damage at a critical moment in trading. The implications extended beyond M&S; customers were also affected. Suppliers faced delayed payments. The media spotlight intensified.

The breach, reportedly linked to the hacking group Scattered Spider – also associated with attacks on Harrods and Co-op, highlighted a fundamental truth: no matter how sophisticated your infrastructure, attackers target people, not just machines.

Cyber Crime is Human-Centred and So Must Be Defence

The BBC’s Panorama documentary Fighting Cyber Criminals aired in July 2025, shedding national light on the scale and shape of the UK’s cyber threat landscape. One key message stood out: most cyber incidents aren’t the result of highly technical exploits, instead, they start with people making mistakes.

“It’s refreshing to see a view of cyber that isn’t about technically skilled criminals doing wizzy technical things to break into organisations. It highlighted that cyber criminals often don’t have deep technical skill and instead use skills in deception to fool helpdesks (people) to give them passwords.”

Phishing. Social engineering. Manipulating support desks. Abusing shared credentials. These tactics bypass traditional defences by preying on the instincts and workloads of real people: overworked contact centre staff, distracted store managers, and under-trained suppliers.

For retail, this is critical. The sector’s frontline workforce is large, decentralised, and customer-facing. Seasonal and part-time contracts are standard. Supply chains are vast, multi-tiered, and often operate with minimal security scrutiny. These are not just operational characteristics, they’re security vulnerabilities.

“ Cyber criminals have learnt how to exploit people for their profits. To beat them we need to be prepared to invest in our people and organisational culture to reduce the opportunity available to the criminals.”

Beyond the Firewall: Rethinking Cyber Resilience in Retail

The retail environment presents unique challenges for cyber defence:

• High transaction volume: Large volumes of customer data and payment details make retailers prime targets for data exfiltration and fraud.
• Supply chain complexity: Third-party risk is amplified through the involvement of multiple suppliers, logistics providers, and technology vendors.
• Legacy systems and POS infrastructure: Many retailers still operate on ageing platforms with known vulnerabilities.
• Public-facing digital assets, such as e-commerce, apps, and loyalty programs, increase exposure.
• High staff turnover: Frequent onboarding and offboarding increases the chance of misconfigurations or account misuse.

Defending this environment requires more than upgraded firewalls. Tom Everard, Director Risk Services recommends:

“Creating a security culture programme in which security awareness and training are just two tools of many used to drive improvements in security behaviour. Apply a human risk management approach whereby data on actual behavioural risk helps to prioritise resource allocation to address those risks that matter most.”

The Regulatory Lens: More Pressure, But Also a Roadmap

Regulators have taken note. The retail sector is increasingly in scope of new cyber resilience rules designed to protect not only business operations, but national infrastructure and consumer safety.

• NIS2, which extends obligations across key sectors in Europe, now includes digital services and supply chain operators, pulling large retailers and platforms into scope.
• DORA may appear finance-focused, but its approach to operational resilience and risk governance is being mirrored across other sectors.
• The UK Government’s cyber strategy, along with increased involvement from the Information Commissioner’s Office (ICO), is likely to result in tighter requirements for breach notification, supply chain assurance, and leadership accountability.

What’s significant is that all these frameworks recognise one thing: cyber security is no longer just about technical controls. It’s about governance, culture, and operational maturity. In other words, it starts with people.

Board-Level Accountability is Now Non-Negotiable

In the aftermath of the M&S attack, company Chair Archie Norman called for mandatory incident reporting laws. His comments reflect a growing expectation: leadership must understand and oversee cyber risk, not simply delegate it.

This requires better communication between technical teams and boards. Retail executives should be asking:

• Where is our most significant exposure to human error?
• How resilient are our operations to ransomware or outages?
• What’s our single point of failure – whether it’s tech, supplier, or person?
• How do we monitor and reduce cyber risk across our stores, apps, and supply chain?
• When was our last cross-functional incident simulation?

Boards must go beyond “Are we secure?” and start asking, “How prepared are we to recover?” Because in retail, minutes of downtime can translate into millions lost and erode trust.

What Good Looks Like in Practice

We can look to the successful application of safety culture in organisations with hazardous work environments like transport and oil and gas to see how the culture approach is able to shift human behaviour. Academic research into safety behaviour began in the 1950s and 60s with subsequent analysis of disasters like Chernobyl, Space Shuttle Challenger, Hillsborough, and numerous rail accidents. This eventually led to safety culture programmes being introduced in the late 1990s/early 2000s with remarkable results. 2016 was the first year in which there were no fatalities of rail workers on the UK rail network. A similar approach is now recognised as being needed to drive the right security behaviours in organisations and businesses.