[non-validated] DORA Threat-led Penetration Testing: Third-Party Participation Requirement (SF A)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the threat-led penetration testing included necessary third-party participants as required by DORA Article 26 during the review period?
Explanation
[non-validated] Has the threat-led penetration testing included necessary third-party participants (e.g., competent authorities, cross-border entities) as required by DORA Article 26 during the current supervisory review period?
Criterion and evidence
Verify documented evidence of required third-party participant inclusion per DORA Article 26 for designated financial entities' jurisdictional scope. Competent authorities and cross-border service providers must be documented in testing scope/plans. Missing evidence remains pending; no automatic failure applies.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
Who qualifies as 'necessary third-party participants' under DORA Article 26?
Competent authorities and entities operating across jurisdictions where the financial provider offers services. Evidence must show documented inclusion in testing scope/plans; exclusion invalidates TLPT compliance.
Does exclusion of required third parties always result in a failed assessment?
Yes, per Article 26 requirements. Evidence showing absence of competent authorities or cross-border entities where jurisdictionally applicable constitutes failure. Partial participation remains deficient.
References
DORA: Threat-led penetration testing