Article 24General requirements for the performance of digital operational resilience testing
What it says
1. For the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.
2. The digital operational resilience testing programme shall include a range of assessments, tests, methodologies, practices and tools to be applied in accordance with Articles 25 and 26.
3. When conducting the digital operational resilience testing programme referred to in paragraph 1 of this Article, financial entities, other than microenterprises, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT risk, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assets and of services provided, as well as any other factor the financial entity deems appropriate.
4. Financial entities, other than microenterprises, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entities shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.
5. Financial entities, other than microenterprises, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.
6. Financial entities, other than microenterprises, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions.
DORA, the European Union regulation on digital operational resilience, Article 24
What it means in practice
The testing programme. Entities other than microenterprises must establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk management framework, to assess preparedness for handling incidents, identify weaknesses, deficiencies and gaps, and promptly implement corrective measures.
The programme includes assessments, tests, methodologies, practices and tools applied under Articles 25 and 26, and must be risk-based, considering the evolving ICT risk landscape, the entity’s specific risks, and the criticality of information assets and services. Tests must be undertaken by independent parties, internal or external; where an internal tester is used, the entity must dedicate sufficient resources and avoid conflicts of interest throughout design and execution.
Procedures and policies must prioritise, classify and remedy all issues the tests reveal, and internal validation methods must confirm that every identified weakness, deficiency or gap is fully addressed.
At least yearly, the entity must ensure that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions. The wording is “appropriate tests”; it does not say every type of test must be run every year.
What a supervisor would ask to see: the approved testing programme, the register of test findings with priority, owner, due date and validated closure, and test records for each system behind a critical or important function (P21-A08, EV-21 to EV-23).
What is in the packs for this
Each one helps with this requirement.
- Excel
DORA Article-to-Control Mapping Library
in DORA ICT Risk & Resilience ReadinessRequirement Library rows RQ-32, RQ-33: A resilience testing programme; Test the systems behind critical functions every year. Each gives the provision in plain words, what to show and the documents that help. - Excel
DORA Readiness Self-Assessment
in DORA ICT Risk & Resilience ReadinessReadiness items RT-01, RT-02: A risk-based resilience testing programme; Systems behind critical or important functions tested every 12 months. Each rates how ready the entity is, with the evidence and the gap. - Excel
Digital Operational Resilience Testing Programme
in DORA ICT Risk & Resilience ReadinessThe Programme and Systems sheets hold the testing programme and when each test falls due; the test log keeps independent tests and links findings to the gap tracker. - Excel
DORA Documentation & Evidence Checklist
in DORA ICT Risk & Resilience ReadinessEvidence records EV-21, EV-22, EV-23: The approved testing programme; The register of test findings with priority, owner, due date and validated closure; Test records for each system behind a critical or important function. - Excel
DORA Gap & Remediation Tracker
in DORA ICT Risk & Resilience ReadinessThe Gaps sheet prioritises, owns and dates every issue a test reveals, and closes it only when another person confirms it is fully addressed. - Word
Tabletop Exercise Design Methodology
in Cyber Incident Exercises & Tabletop Scenario LibraryPlaces the tabletop within a testing programme and sets the finding priority, improvement actions and re-tests. - Excel
Exercise Observations & Improvement Tracker
in Cyber Incident Exercises & Tabletop Scenario LibraryPriority, due date and re-test columns prioritise issues the tests reveal, remedy them and check they are fully addressed.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.