[non-validated] DORA SFS B / SF 4: Operational Resilience Testing Program - Post-Remediation Validation
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity provided documented evidence verifying that remediation of all identified test findings effectively resolved the underlying vulnerabilities during the review period?
Explanation
[non-validated] Does the designated entity maintain documented evidence verifying that remediation of all identified test findings effectively resolved the underlying vulnerabilities through validated post-remediation testing during the review period?
Criterion and evidence
Verify compliance with DORA Article 24 requiring documented evidence of post-remediation validation confirming resolution of all identified test findings within the review period for designated entities under the basic operational resilience testing regime. Exclude advanced TLPT requirements addressed in SFS C.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for post-remediation validation?
Documented evidence dated within the review period showing retesting or other validation methods confirming vulnerabilities were fully resolved. Must demonstrate effectiveness of fixes for all critical findings identified in testing.
Are there acceptable alternatives to documented post-remediation validation?
No valid alternatives satisfy repository requirements. Evidence of validated effectiveness is mandatory per keyDescription ('verified remediation evidence'); absence results in pending status.
References
DORA: Digital operational resilience testing programme