[non-validated] DORA SFS C / SF D (Critical function scope coverage)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the threat-led penetration testing explicitly covered all identified critical ICT functions as required by DORA Article 26(3) during the review period?
Explanation
[non-validated] Has the threat-led penetration testing covered all critical ICT functions as required by DORA Articles 26-27 during the review period?
Criterion and evidence
Designated financial entity under DORA; compliance with critical function scope coverage per Articles 26-27; current supervisory review period; verified documentation showing TLPT scope explicitly mapped to all critical ICT functions identified
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for this requirement?
Documented test plan or report explicitly listing all critical ICT functions within the TLPT scope as mandated by DORA Articles 26-27. No alternative satisfies the criterion; requirement applies exclusively to designated entities under TLPT obligations. Missing evidence remains pending verification.
References
DORA: Threat-led penetration testing