[non-validated] DORA SFS C / SF 8: Mutual Recognition of TLPT Results under Article 27
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Where applicable under DORA Article 27, has the entity properly recognized and applied threat-led penetration test results from another competent authority during the review period?
Explanation
[non-validated] Where applicable under DORA Article 27 for cross-border financial services, has the designated entity properly applied mutual recognition of threat-led penetration test results from another competent authority during the review period?
Criterion and evidence
Verify mutual recognition application per DORA Art.27 for entities providing cross-border services; confirm documented procedures accepting valid TLPT reports from other Member States' competent authorities; excludes non-applicable (single-Member-State) entities and pending documentation cases
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What evidence is required to satisfy mutual recognition compliance?
Verified documentation showing acceptance of valid TLPT reports from other competent authorities for cross-border services, without creating redundant tests. Single-Member-State operators must document non-applicability.
How is missing evidence treated for this requirement?
Pending verification where documentation isn't provided. Claims of non-applicability require proof of no cross-border operations; absence of records results in pending status, not automatic failure.
References
DORA: Threat-led penetration testing