[non-validated] DORA: Operational Resilience Testing Coverage (Article 24) - Repository Draft
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity documented verified operational resilience test reports covering all ICT critical functions identified in the latest risk assessment during the review period per repository topic boundaries?
Explanation
[non-validated] Per repository topic boundaries (inputs/json/en/B.json), the entity must maintain a documented operational resilience testing program demonstrating testing coverage for all ICT critical functions identified in the latest risk assessment during the review period, with evidence of test planning methodology, independence, system/function coverage validation, and verified remediation. This draft reflects unverified repository content without legal verification.
Criterion and evidence
Assess documented evidence per repository topic boundaries: operational resilience testing for all risk-assessed ICT critical functions during the review period, including planning methodology, independent execution, coverage validation, and verified remediation (excludes TLPT regime in SFS C). This reflects unverified repository content; no legal verification or compliance assessment is implied.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Per repository documentation, sufficient evidence includes test reports dated within the review period demonstrating execution for all ICT critical functions identified in the latest risk assessment, including infrastructure and application layers with findings closure verification. Note: Repository template is not verified legal evidence.
Are there acceptable alternatives to full coverage testing?
Per repository keyDescription ('relevant systems/functions'), no alternatives satisfy the requirement; full coverage of all risk-identified critical functions is mandatory. This reflects unverified repository content without current legal verification.
References
DORA: Digital operational resilience testing programme