[non-validated] DORA Threat-led Penetration Testing: Vulnerability Remediation Documentation (SF C9)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated financial entity documented remediation of critical vulnerabilities identified in the threat-led penetration test as required by DORA Article 26(5) during the review period?
Explanation
[non-validated] Does the designated financial entity subject to TLPT under DORA maintain documented evidence of remediating all critical vulnerabilities identified in the threat-led penetration test as required by Article 26 during the current supervisory review period?
Criterion and evidence
Verify documented remediation of critical vulnerabilities per DORA Article 26 including implementation evidence, validation records, and updated risk assessment within the review period for entities subject to TLPT requirements.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
An official TLPT report showing documented remediation plans with implementation evidence, validation results, and updated risk assessments for all critical vulnerabilities identified in the test during the review period per DORA Article 26.
Are alternative evidence forms acceptable?
No. DORA Article 26 explicitly requires analysis of test results and implementation of necessary corrective measures; alternative implementations cannot satisfy this specific remediation documentation requirement.
References
DORA: Threat-led penetration testing