[non-validated] DORA SFS C / SF F: TLPT Scope Documentation Requirement
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the threat-led penetration testing explicitly defined and documented its scope including all critical ICT functions and required testing parameters as mandated by DORA Articles 26-27 during the review period?
Explanation
[non-validated] Does the designated financial entity under DORA explicitly document the scope of its threat-led penetration testing to include all critical ICT functions and mandated parameters from DORA Articles 26-27 during the review period?
Criterion and evidence
Verify authority-approved TLPT scoping document explicitly covers all critical ICT functions and required elements per DORA Articles 26-27, including threat intelligence parameters and tester qualifications. Test schedules or infrastructure documentation alone are insufficient evidence.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Threat-led penetration testing. Determine TLPT applicability and govern advanced testing where the entity is selected or required to participate. Cover authority-driven selection, test scope, critical functions, tester independence/qualification, threat intelligence, live-system safeguards, third-party participation, remediation and mutual recognition. Do not impose TLPT on all financial entities or claim tests were executed by generating a plan. DORA article references: 26, 27. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
What constitutes sufficient evidence for scope validation?
Official TLPT scoping document approved by competent authority per DORA Articles 26-27, detailing coverage of all critical ICT functions and mandated elements including threat intelligence parameters and tester qualifications. Test schedules or infrastructure-only documentation are insufficient.
Are alternatives accepted when scope documentation is incomplete?
No. DORA Articles 26-27 require explicit scope definition without substitution options. Missing evidence remains pending; partial submissions constitute failure as no alternative satisfies the criterion.
References
DORA: Threat-led penetration testing