[non-validated] DORA SFS C / SF E: Critical functions coverage in threat-led penetration testing
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the threat-led penetration testing covered all identified critical ICT functions as required by DORA Articles 26-27 during the review period?
Explanation
[non-validated] Has the designated financial entity, as selected by a supervisory authority under DORA Articles 26-27, provided verified documentation showing threat-led penetration testing explicitly covered all critical ICT functions during the review period? Unselected entities remain out of scope; absence of documentation results in pending status.
Criterion and evidence
Applicable exclusively to financial entities designated under DORA Articles 26-27. Evidence must verify explicit inclusion of all critical ICT functions (per DORA Art. 2(2)) in threat-led penetration testing scope during current supervisory period. Pass: official test report listing all critical functions. Fail: documented exclusion of critical functions. Pending: no scope documentation. No alternative satisfies the criterion.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
How is 'critical ICT functions' defined for this condition?
Defined per DORA Article 2(2) as functions whose failure would materially disrupt service continuity. Must be explicitly identified in risk assessments and mapped to tested systems in the TLPT report.
What qualifies as valid evidence when documentation is incomplete?
Pending status applies if test documentation references critical functions generally but provides no specific system mapping. Complete evidence requires explicit listing of both identified critical functions and corresponding test scenarios covering each.
References
DORA: Threat-led penetration testing (Repository Template)