[non-validated] DORA Compliance: Threat-led Penetration Testing (SFS C/SF 1)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated financial entity conducted threat-led penetration testing covering critical ICT functions as required by DORA Articles 26-27 during the review period, with documented evidence of tester independence and remediation?
Explanation
[non-validated] Designated financial entities under DORA must conduct threat-led penetration testing (TLPT) on critical ICT functions as specified in Articles 26-27. This requires documented evidence of tester independence, threat intelligence coverage, and validated remediation within the current supervisory review period. Absence of evidence results in pending status; no automatic failure applies.
Criterion and evidence
Per DORA Articles 26-27 and Article 2(2) definitions, applicable entities must execute TLPT covering critical ICT functions with evidence of: (1) Competent authority-approved report, (2) Threat intelligence integration, (3) Tester independence verification, (4) Critical function validation, and (5) Remediation validation. Mutual recognition (Art. 27) does not waive requirements. Critical functions include those whose failure would materially disrupt service continuity.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence satisfies TLPT compliance?
An official report approved by competent authorities demonstrating threat intelligence coverage, tester independence per Article 26(4), critical function validation, and documented remediation. Schedule documentation alone is insufficient.
How are missing evidence cases handled?
Status remains 'pending' until verified evidence is provided. Absence of documentation does not constitute compliance failure but prevents positive assessment. Entity role and scope must first confirm applicability.
References
DORA: Threat-led penetration testing