[non-validated] DORA SFS C / SF B: Competent authority selection for threat-led penetration testing
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has this designated financial entity been selected by the competent authority to undergo threat-led penetration testing as required by DORA Article 26 during the review period?
Explanation
[non-validated] Has the designated financial entity been selected by its competent authority to undergo threat-led penetration testing as required under DORA Article 26(1) during the current supervisory review period?
Criterion and evidence
Assess TLPT applicability based on competent authority determination per DORA Article 26(1). Valid evidence requires official documentation specifying entity's selection for TLPT, considering entity role (designated financial entity, excluding entities with limited critical function scope), critical functions as defined in Articles 3-4, and current regulatory framework. Evidence period aligns with supervisory review cycle. No alternatives satisfy this requirement.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes valid evidence for this condition?
Official determination document from competent authority (e.g., Bank of Greece) explicitly citing DORA Article 26(1) and mandating TLPT for the entity's critical functions. Regulatory filings acknowledging pending determination count as missing evidence.
How is entity scope determined?
Applies exclusively to designated financial entities under DORA supervision with critical functions as defined in Articles 3-4. Explicit national exclusions for entities with limited critical function scope render them out of scope.
How are missing or contradictory records handled?
Pending verification when evidence of competent authority's determination is unavailable. Contradictory records require resolution through most recent official determination aligned with current regulatory status.
References
DORA: Threat-led penetration testing topic definition