[non-validated] DORA SFS B / SF 2: Operational Resilience Testing Scope Coverage
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] During the review period, does the documented operational resilience testing program explicitly specify all relevant ICT systems and critical business functions covered as required by repository topic boundaries?
Explanation
[non-validated] Ensures designated entities maintain a documented operational resilience testing program explicitly covering all relevant ICT systems and critical business functions as defined by repository topic boundaries. Assessed against documented scope specifications and risk-based methodology evidence during the review period.
Criterion and evidence
Verify repository-specified requirement by confirming documented testing program scope (ICT systems/critical business functions) with risk-based methodology evidence per topic boundaries. Exclude advanced TLPT regime (SFS C). Evidence period: current review period per repository documentation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence confirms adequate testing scope coverage?
Documented testing program scope explicitly listing all relevant ICT systems and critical business functions as defined by repository topic boundaries, supported by risk assessment methodology showing relevance determination. Missing coverage documentation results in pending assessment per repository-specified requirements.
References
DORA: Digital operational resilience testing programme