[non-validated] DORA SFS B / SF 8: Documented Risk-Based Test Planning Methodology
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented a risk-based test planning methodology specifying frequency determination, scope boundaries, and resource allocation aligned with its risk assessment for the operational resilience testing programme during the review period?
Explanation
[non-validated] The designated digital service provider must demonstrate documented evidence of a risk-based approach to operational resilience test planning, specifying how test frequency, scope boundaries, and resource allocation are determined in alignment with their current risk assessment during the review period.
Criterion and evidence
Verifies documented test planning records from the review period showing risk-based determination of test frequency (e.g., quarterly for high-risk systems), scope boundaries mapped to critical systems identified in the latest risk assessment, and resource allocation methodology per DORA Article 24. Applies to designated digital service providers under the basic operational resilience testing program; excludes advanced TLPT regime covered in SFS C. Fragmentary documentation lacking required elements constitutes failure.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What specific evidence is required to demonstrate compliance with this condition?
Sufficient evidence includes dated test planning documentation from the review period containing: (1) risk-tiered determination of test frequency (e.g., quarterly for high-risk systems), (2) scope boundaries explicitly mapped to critical systems identified in the latest risk assessment, and (3) resource allocation methodology showing staffing/tools allocated for testing. Generic testing policies without these specific elements are insufficient.
How are partial or missing elements treated in submitted documentation?
Documentation remains pending assessment if no test planning records are provided. It fails if provided documentation lacks any required element (frequency determination methodology, scope boundaries, or resource allocation). Evidence of partial implementation (e.g., risk-based frequency but no scope boundaries) constitutes failure per DORA Article 24 requirements.
References
DORA: Digital operational resilience testing programme