Article 25Testing of ICT tools and systems
1. The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
2. Central securities depositories and central counterparties shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions of the financial entity.
3. Microenterprises shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of information assets and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks, on the other hand.
DORA, the European Union regulation on digital operational resilience, Article 25
What counts as a test. The programme must provide for appropriate tests, in line with proportionality under Article 4(2), such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
Central securities depositories and central counterparties must perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and of ICT services supporting critical or important functions. Microenterprises perform the tests by combining a risk-based approach with strategic planning of testing, balancing the resources and time allocated against urgency, type of risk and the criticality of assets and services.
Two points to draw out. The list in paragraph 1 is illustrative (“such as”): the programme provides for appropriate tests in line with Article 4(2), and a named test is required where another provision says so, as paragraph 2 does for vulnerability assessments and Article 26 does for threat-led penetration testing. And the list is broader than technical scanning, including physical security reviews and questionnaires, so a programme should not be assumed to be only technical.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-34, RQ-35, RQ-36: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items RT-01 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
Digital Operational Resilience Testing ProgrammeExcel
in DORA ICT Risk & Resilience Readiness
The test types table lists twelve kinds of test (DT-01 to DT-12) and counts those planned or recorded, including microenterprise and depository or counterparty variations.
DORA Documentation & Evidence ChecklistExcel
in DORA ICT Risk & Resilience Readiness
Evidence records EV-21: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Tabletop Exercise Design MethodologyWord
in Cyber Incident Exercises & Tabletop Scenario Library
Describes the tabletop as a scenario-based test.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.