Regulators Everywhere Are Converging on the Same Question

If you run a financial institution or a piece of critical infrastructure, the number of cyber resilience regulations you answer to has grown considerably over the past two years. DORA in Europe. FINMA in Switzerland. RMiT in Malaysia. Evolving operational resilience expectations from the CBUAE, SAMA, and the NCA across the Gulf.

At first glance they look like a patchwork, each with its own language, thresholds, and reporting requirements. Read them closely though and they are converging on the same underlying question.

It's no longer "do you have controls in place?" The question regulators are asking now is whether you can prove those controls work under realistic conditions.

What DORA Made Explicit

The European Union's Digital Operational Resilience Act, in full force since January 2025, is the most prescriptive example of this shift. It doesn't just ask financial entities to be secure. It tells them how to prove it.

At the centre of DORA sits a requirement called Threat-Led Penetration Testing. For significant financial entities, TLPT is mandatory at least every three years. And it is not a conventional penetration test. It has to be based on real threat intelligence that reflects how actual adversaries behave. It has to run against live production systems, not isolated test environments. And it has to produce a documented report reviewed by the institution's management body.

Those details matter. DORA is codifying the difference between testing that looks reassuring and testing that reflects reality. For the institutions that matter most, a conventional pen test against a controlled environment no longer meets the standard.

The Same Logic, Everywhere

Once you see that pattern in DORA, you start to see it everywhere.

Switzerland's FINMA Circular 2023/1 sets one of the most demanding operational resilience standards in the world, requiring institutions to identify critical functions and show they can maintain them through severe but plausible disruption. Three of the five largest Swiss banks already run regular DDoS resilience simulations to meet that expectation.

Malaysia's Bank Negara updated its Risk Management in Technology policy in November 2025. It now requires financial institutions to run realistic attack simulations against their infrastructure at least once every three years, with a maximum tolerable downtime of 120 minutes for critical systems.

Across the Gulf the direction is the same, even where the language is less prescriptive. The CBUAE requires annual security assessments and business continuity testing. SAMA's frameworks focus on an institution's ability to maintain critical operations during a cyber incident. The UAE National Cyber Security Strategy 2025-2031 has formally moved the sector from voluntary compliance toward mandatory resilience.

Different regulators, different jurisdictions, different acronyms. The same requirement underneath: demonstrate, don't assume.

Why This Convergence Is Happening

This isn't a coincidence of timing. It reflects a shared recognition among regulators that the old model of resilience assurance no longer holds.

For most of the past two decades, cyber resilience was treated as a controls problem. Deploy the right tools, document the right policies, pass the annual audit. That approach made sense when attacks were less frequent, less sophisticated, and less capable of causing systemic disruption.

That world is gone. Attacks are now persistent, distributed, and increasingly powered by AI that can mimic legitimate activity and adapt in real time. Regulators have watched critical infrastructure come under sustained pressure in other markets and concluded that documentation is not evidence. The only way to know whether an institution can withstand an attack is to test it under conditions that resemble a real one.

That conclusion is what unites DORA, FINMA, RMiT, and the emerging GCC frameworks. Same threat environment, same answer.

What This Means for Institutions in the Region

For financial institutions and critical infrastructure operators across the GCC and Southeast Asia, the practical implication is simple. The regulatory direction is already set, and it is set globally. The specific local requirement may still be evolving, but the destination is not in doubt.

The institutions getting ahead of this are treating resilience testing as an ongoing capability rather than a periodic obligation. They validate their defences against realistic, distributed attack conditions. They produce evidence that stands up to a regulator, an auditor, or a board. And they do it before a local mandate forces the timeline.

For DDoS resilience specifically, that means testing against the kind of distributed, residential traffic that real attacks use rather than synthetic traffic from a controlled environment, and producing a tamper-proof, independently verifiable report at the end of it.

If your institution is subject to any of these frameworks, or expects to be soon, it is worth understanding what demonstrable resilience looks like in practice before the question arrives from a regulator. That is a conversation we're always happy to have.