[non-validated] DORA SFS C / SF 7 (repository-sourced template; no legal verification)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated financial entity undergone threat-led penetration testing at least every three years and following any significant change to critical ICT functions as mandated by DORA Article 26 during the review period?
Explanation
[non-validated] Per repository template documentation, designated financial entities must undergo threat-led penetration testing where applicable under DORA. This covers testing scope definition, critical functions inclusion, and remediation validation as specified in template guidance. Repository sources provide general framework without verifying specific legal requirements; absence of evidence maintains pending status. Non-designated entities are excluded from TLPT obligations per template definitions.
Criterion and evidence
Actor: Applicable designated financial entity per repository template scope. Scope: TLPT applicability parameters including authority-driven selection, critical functions coverage, and remediation per template C.json. Evidence period: Current supervisory review period. Required evidence: Documentation demonstrating compliance with template-specified testing parameters. Negative: Evidence shows non-compliance with template-defined scope and validation requirements. Missing evidence: Pending submission of required documentation. Alternatives: Applies exclusively to designated entities; non-designated entities excluded per repository template documentation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes valid testing scope under this condition?
Per repository template C.json, scope must cover authority-driven selection, critical functions definition, tester independence verification, and remediation validation. Test schedules alone are insufficient; evidence requires documented test reports demonstrating template-specified parameters.
How is entity applicability determined for this requirement?
Template documentation specifies applicability exclusively to designated financial entities under DORA Article 2(2). Non-designated entities are automatically excluded without requiring evidence. Assessment requires verification of entity designation status from external sources beyond repository template scope.
References
DORA: Threat-led penetration testing (repository template)