# Financial Firms Strengthen Cybersecurity Testing

Guidance for financial-services organizations recommends assigning cybersecurity architecture assumptions to independent testing functions, documenting gaps that remain untested, and escalating findings for remediation. In-scope firms must also account for DORA’s threat-led penetration testing requirements. For procurement teams and service providers, the guidance points to potential demand for independent testing, automated validation, and provider attestations; it does not identify a specific solicitation, award, or contract value.

- Organizations buying cybersecurity services can evaluate whether independent testing and automated validation address their documented testing gaps and support escalation of findings for remediation.
- Providers may find opportunities to offer independent testing, validation tools, or attestations to financial-services clients, including firms subject to DORA requirements.
- Procurement teams should distinguish general architecture testing needs from DORA-related threat-led penetration testing when defining service scopes; the signal provides no specific procurement deadline or opportunity.

**Jurisdictions:** international
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 29, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- European Union (EU)

### Sources
- [Assigning an assumption to the function best placed to test it | tech-explainer | SC Media](https://www.scworld.com/tech-explainer/assigning-an-assumption-to-the-function-best-placed-to-test-it) - SC Media