[non-validated] DORA SFS B / SF 5 - Organizational Separation in Test Teams
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated digital service provider ensured organizational separation between operational resilience test design and execution teams during the review period?
Explanation
[non-validated] Has the designated digital service provider documented organizational separation between operational resilience test design and execution teams with no role overlap during the review period?
Criterion and evidence
For designated digital service providers under DORA Article 24, verify documented evidence (e.g., organizational charts or role specifications) confirming separation between test design and execution functions with no overlapping responsibilities during the current review period. Applies to basic operational resilience testing program; excludes advanced TLPT regime in SFS C.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence confirms organizational separation between test teams?
Documented organizational charts or role specifications dated within the review period showing distinct reporting lines and no overlapping responsibilities between test design and execution functions. Evidence must specify team structures and accountability boundaries.
How are missing evidence situations handled?
Pending assessment when documentation is incomplete or unavailable. No alternatives satisfy DORA Article 24 requirements per repository documentation; absence of evidence does not imply compliance.
References
DORA: Digital operational resilience testing programme