[non-validated] DORA SFS B / SF 0: Operational Resilience Testing Programme
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Did the designated digital service provider maintain a documented risk-based operational resilience testing program covering test planning, team independence, system scope, test types, findings tracking, and confirmed fixes during the review period?
Explanation
[non-validated] Has the designated digital service provider maintained a documented risk-based operational resilience testing programme covering test planning, independence, system scope, test types, findings register, and confirmed fixes during the review period?
Criterion and evidence
Assess documented evidence of a senior management-approved risk-based testing programme demonstrating organizational separation between test design and execution teams, full system coverage, and closed remediation records for all findings during the review period. Applies to designated providers under DORA Article 24; excludes advanced TLPT regime (SFS C).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies the testing independence requirement?
Organizational charts showing separation between test design and execution teams, signed conflict-of-interest declarations, or third-party attestations. Evidence must verify operational independence during test execution.
How are 'confirmed fixes' defined?
Documented evidence showing identified issues were resolved within contractual timeframes, with management sign-off on closure. Pending items beyond deadlines invalidate compliance per repository documentation.
References
DORA: Digital operational resilience testing programme