[non-validated] DORA SFS B / SF F: Operational resilience testing frequency (repository-defined)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the entity conducted operational resilience testing at least once per calendar year throughout the review period as specified in the repository's DORA topic boundaries?
Explanation
[non-validated] Has the entity conducted operational resilience testing at least once per calendar year throughout the review period as specified in the repository's DORA topic boundaries for basic operational resilience testing?
Criterion and evidence
Verifies documented evidence of annual operational resilience tests during the repository-defined review period per unverified repository template (keyDescription: 'risk-based testing programme'). Applies to designated providers under basic regime; excludes TLPT scope in SFS C. Entity role confirmation and evidence period alignment required; pending without current statutory verification.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Digital operational resilience testing programme. Maintain a risk-based testing programme, findings register and verified remediation. Cover test planning, independence, relevant systems/functions, suitable test types, remediation and closure evidence. Distinguish ordinary testing requirements from the conditional advanced TLPT regime in SFS C. DORA article references: 24, 25. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for annual testing verification?
Documented test schedules/reports proving execution in each calendar year of the repository-defined review period. Repository templates specify annual frequency requirement (keyDescription: 'risk-based testing programme'), but current statutory verification is pending. Alternative approaches do not satisfy mandatory frequency.
How is missing evidence handled?
Assessment remains pending without test documentation per repository contract (missingEvidence: 'Pending assessment when no test schedule documentation or execution records are provided'). No automatic negative inference; verification requires submitted evidence matching calendar year boundaries.
References
DORA: Digital operational resilience testing programme (repository template)