[non-validated] DORA SFS F / SF 6: Operational resilience testing by designated critical ICT providers (Article 37)
Generated catalog draft. No operational assessment or human approval is claimed.
[non-validated] This question has unresolved selected work.
Question
[non-validated] Has the designated critical ICT provider conducted operational resilience testing as required by DORA Article 37?
Explanation
[non-validated] Has the entity formally designated as a critical ICT provider under DORA Article 14 conducted operational resilience testing as required by DORA Article 37(3)-(4) within the applicable evidence period?
Criterion and evidence
Applies exclusively to entities designated as critical ICT providers under DORA Article 14 (excludes financial entities/ordinary ICT providers). Evidence period aligns with current lead overseer/competent authority specifications per Article 37(3). Positive requires dated test execution reports demonstrating resilience standards met per Article 37(4); negative requires absence of mandated testing documentation. Missing evidence remains pending. No valid alternatives satisfy the statutory obligation.
AI assistance prompt
Develop sixteen bounded yes/no factors for DORA: Critical provider oversight and supervisory readiness. Prepare the assessed entity for applicable critical-provider oversight and supervisory cooperation. Distinguish financial-entity duties from duties of designated critical ICT providers and powers of ESAs/competent authorities. Cover designation implications, supervisory requests, access/inspection cooperation, oversight findings, remediation and records. Never score an authority power as an operational duty of an ordinary provider or financial entity. DORA article references: 31-44, 46-56. Verify entity-role applicability and current primary sources. Missing evidence stays pending; no compliance or assessment is implied.
Clarifications
How is 'designated critical ICT provider' scope defined?
Evidence must confirm formal designation under DORA Article 14. Financial entities are excluded per Article 2(7); ordinary ICT providers without critical designation fall outside scope. Non-applicability requires explicit documentation of non-designation status.
What evidence demonstrates completed operational resilience testing?
Acceptable evidence includes dated test plans showing required frequency per Article 37(3), execution reports with results, and documentation proving resilience standards were met per Article 37(4). A schedule alone is insufficient evidence of completed testing.
How is missing evidence handled?
Pending when no evidence is submitted for review. Partial evidence showing testing outside required intervals or unmet standards is treated as failed until remediation is demonstrated. Non-applicability must be explicitly documented per DORA definitions.
References
DORA: Critical provider oversight area specification