[non-validated] DORA SFS 4 / SF B: Pre-deployment Security Testing Procedures
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical entity implemented documented pre-deployment security testing procedures for ICT changes as defined in the repository topic description during the evidence period?
Explanation
[non-validated] Has the designated critical entity implemented documented pre-deployment security testing procedures for ICT changes as defined in the repository topic description during the evidence period?
Criterion and evidence
Verify documented evidence of pre-deployment security testing procedures per repository topic description requirements. Must include defined test protocols with validation criteria, evidence records of executed tests, and explicit coverage of all ICT systems supporting essential services. Evidence period aligns with current operational review cycle. Missing documentation remains pending; no automatic negative finding applies.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Secure change, development and vulnerability management. Control ICT changes, software/system development, vulnerabilities and patching. Cover acquisition and development controls, testing before deployment, change approval, emergency changes, patching, vulnerability treatment and supported-system lifecycle. Use the applicable ICT-risk technical standards; do not substitute a generic development maturity score. DORA article references: 7, 9, 15. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of documented pre-deployment security testing?
Valid evidence requires organizationally approved policy documents showing: (1) Defined security testing protocols with specific validation criteria per repository topic description, (2) Records of executed tests with documented evidence for non-emergency changes, (3) Explicit coverage of all ICT systems supporting essential services. Generic maturity scores are insufficient substitutes.
How are emergency changes treated under this requirement?
Emergency changes are explicitly excluded from this criterion. They are covered under SF 4 (SFS 4 / SF 4) as specified in repository topic description keyDescription. This requirement applies strictly to pre-deployment testing for non-emergency ICT changes.
References
DORA: Secure change, development and vulnerability management