Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Article 24General requirements for the performance of digital operational resilience testing

1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.

2. The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26.

3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.

4. Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entities shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.

5. Financial entities, other than microenterprises, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.

6. Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.

DORA, the European Union regulation on digital operational resilience, Article 24

The testing programme. Entities other than microenterprises must establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework, to assess preparedness for handling incidents, identify weaknesses, deficiencies and gaps, and promptly implement corrective measures.

The programme includes a range of assessments, tests, methodologies, practices and tools applied under Articles 25 and 26, and must follow a risk-based approach considering the evolving ICT risk landscape, the specific risks the entity is or may be exposed to, the criticality of information assets and of the services provided, and any other factor the entity deems appropriate. Tests must be undertaken by independent parties, internal or external; where an internal tester is used, the entity must dedicate sufficient resources and avoid conflicts of interest throughout design and execution.

Procedures and policies must prioritise, classify and remedy all issues the tests reveal, and internal validation methods must confirm that every identified weakness, deficiency or gap is fully addressed.

At least yearly, the entity must ensure that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions. The wording is “appropriate tests”; it does not say every type of test must be run every year.

What is in the packs for this

Each one helps with this requirement.

  • DORA Article-to-Control Mapping LibraryExcel

    in DORA ICT Risk & Resilience Readiness

    Requirement Library rows RQ-32, RQ-33: each gives the provision in plain words, what an entity must be able to show and the documents that help.

  • DORA Readiness Self-AssessmentExcel

    in DORA ICT Risk & Resilience Readiness

    Readiness items RT-01, RT-02 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.

  • Digital Operational Resilience Testing ProgrammeExcel

    in DORA ICT Risk & Resilience Readiness

    The Programme and Systems sheets hold the testing programme and when each test falls due; the test log keeps independent tests and links findings to the gap tracker.

  • DORA Documentation & Evidence ChecklistExcel

    in DORA ICT Risk & Resilience Readiness

    Evidence records EV-21, EV-22, EV-23: the records a supervisor can ask for under the provision, with who keeps them and for how long.

  • DORA Gap & Remediation TrackerExcel

    in DORA ICT Risk & Resilience Readiness

    The Gaps sheet prioritises, owns and dates every issue a test reveals, and closes it only when another person confirms it is fully addressed.

  • Tabletop Exercise Design MethodologyWord

    in Cyber Incident Exercises & Tabletop Scenario Library

    Places the tabletop within a testing programme and sets the finding priority, improvement actions and re-tests.

  • Exercise Observations & Improvement TrackerExcel

    in Cyber Incident Exercises & Tabletop Scenario Library

    Priority, due date and re-test columns prioritise issues the tests reveal, remedy them and check they are fully addressed.

Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.