[non-validated] DORA SFS C / SF 2: Threat-led penetration testing - tester independence
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Did the designated financial entity use independent, qualified testers for required threat-led penetration tests under DORA Articles 26-27 during the review period?
Explanation
[non-validated] Supporting fields await model review. Proposed positive criterion: Verified documentation proving tester independence and qualification credentials compliant with DORA Articles 26-27.
Criterion and evidence
Actor: Designated financial entity under DORA. Scope: Threat-led penetration testing for critical ICT functions per DORA Articles 26-27. Evidence period: Current supervisory review period. Required evidence: Official test report demonstrating tester independence and qualifications compliant with DORA Articles 26-27. Negative criterion: Evidence shows testers lacked required independence or formal qualifications specified in DORA Articles 26-27. Missing evidence: Pending submission of tester qualification and independence verification per DORA Articles 26-27. Alternatives: Requirement applies exclusively to designated entities; non-designated financial entities are excluded from TLPT obligations under DORA Article 2(2) as stated in repository documentation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
How is 'independent and qualified tester' defined for TLPT under DORA?
Per repository template C-repository-area, 'independent' requires conflict-of-interest verification and 'qualified' requires formal credentials aligned with DORA Articles 26-27. Non-designated entities are excluded per DORA Article 2(2). Evidence must be contained in official test reports; test plans alone are insufficient.
References
DORA: Threat-led penetration testing