[non-validated] DORA SFS C / SF 6: Live-System Safeguards in Threat-Led Penetration Testing
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the threat-led penetration testing implemented safeguards to prevent disruption of live production systems as required by DORA Article 26 during the review period?
Explanation
[non-validated] Has the designated financial entity implemented documented safeguards to prevent disruption of live production systems during threat-led penetration testing as required by DORA Article 26 within the current supervisory review period?
Criterion and evidence
Verify documented evidence of isolation measures (network segmentation) and validated rollback procedures for live-system safeguards during TLPT by DORA-designated financial entities per Article 26 within current review period. Critical functions scope applies only to designated entities under Article 2(2).
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for DORA Article 26 live-system safeguards compliance?
Verified documentation showing isolated testing environments with network segmentation, validated rollback procedures, and explicit confirmation that production systems remained operational during testing. Test reports must demonstrate no disruption to live customer transaction systems.
How are incomplete or missing safeguards treated under DORA requirements?
Testing conducted directly on live systems without isolation measures or documented mitigation planning constitutes non-compliance. Absence of safeguard implementation evidence in submitted materials leaves the requirement as 'pending verification' without automatic failure.
References
DORA: Threat-led penetration testing