[non-validated] DORA SFS C / SF 3: Threat intelligence in threat-led penetration testing
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Did the threat-led penetration test include documented threat intelligence relevant to critical ICT functions as required by DORA Article 26 during the review period?
Explanation
[non-validated] Has the threat-led penetration test incorporated documented threat intelligence specifically relevant to critical ICT functions as mandated by DORA Article 26 during the current supervisory review period?
Criterion and evidence
Verify designated financial entity compliance with DORA Article 26. Evidence period: current supervisory cycle. Requires TLPT report demonstrating threat intelligence directly relevant to critical ICT functions. Missing evidence = pending; no valid alternatives satisfy criterion.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence of threat intelligence relevance?
Completed TLPT report citing documented, current threat intelligence explicitly tied to the entity's critical ICT functions (e.g., payment systems). Generic vulnerability scans without sector-specific references are insufficient.
How are absent or inadequate evidence scenarios assessed?
Missing evidence (e.g., test schedule without verification documentation) results in pending status. Evidence showing generic scanning without threat intelligence integration constitutes non-compliance per DORA Article 26. No alternatives satisfy this requirement.
References
DORA: Threat-led penetration testing