[non-validated] DORA SFS C / SF 4: Tester Independence and Qualification
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the threat-led penetration testing been conducted by an independent and qualified tester as required by DORA Article 26 during the review period?
Explanation
[non-validated] Has the designated financial entity conducted threat-led penetration testing with an independent and qualified tester as required by DORA Article 26 during the current review period?
Criterion and evidence
Applies to designated financial entities subject to TLPT under DORA. Verify tester independence (no conflicts of interest) and qualification (ENISA-recognized expertise) per Article 26. Evidence must cover current supervisory period. Pass: documented test report with verified credentials. Fail: internal staff testing or unverified qualifications. Pending without proof.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for tester qualification?
Requires documented proof of ENISA-recognized certification and financial sector experience. Evidence must show no conflicts of interest between tester and entity. Internal staff testing without third-party validation fails this criterion per Article 26.
References
DORA: Threat-led penetration testing