[non-validated] DORA SFS B / SF 3: Test Type Specifications for Critical Systems
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] During the review period, does the documented operational resilience testing program explicitly specify suitable test types, including penetration testing and automated scanning for critical systems identified in the risk assessment, as required by repository topic boundaries?
Explanation
[non-validated] Does the documented operational resilience testing program specify suitable test types, including penetration testing and automated scanning for systems identified as critical through risk assessment, as required by the repository's topic boundaries?
Criterion and evidence
For entities designated under the DORA framework per repository allocation, verify evidence that the testing program document explicitly specifies required test types (e.g., penetration testing, automated scanning) for critical systems identified in the risk assessment during the current review period. Scope covers basic testing requirements; excludes advanced TLPT regime in SFS C. Missing evidence results in pending status.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies the test type specification requirement?
Documented testing program evidence showing explicit selection of suitable test types (e.g., penetration testing for high-risk systems, automated scanning) mapped to critical systems identified in the latest risk assessment methodology. Pending when documentation lacks test-type specifications or risk-based justification.
Are alternatives accepted if penetration testing is omitted for critical systems?
No valid alternatives satisfy repository requirements per topic boundaries. Omission of required test types for risk-identified critical systems constitutes failure regardless of compensating controls.
References
DORA: Digital operational resilience testing programme