Article 25Testing of ICT tools and systems
What it says
1. The digital operational resilience testing programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
2. Central securities depositories and central counterparties shall perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT services supporting critical or important functions of the financial entity.
3. Microenterprises shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of information assets and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks, on the other hand.
DORA, the European Union regulation on digital operational resilience, Article 25
What it means in practice
What counts as a test. The programme must provide for appropriate tests, in line with proportionality under Article 4(2), such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
Central securities depositories and central counterparties must perform vulnerability assessments before any deployment or redeployment of new or existing applications and infrastructure components, and of ICT services supporting critical or important functions. Microenterprises perform the tests by combining a risk-based approach with strategic planning of testing, balancing the resources and time allocated against urgency, type of risk and the criticality of assets and services.
Two points to draw out. The list in paragraph 1 is illustrative (“such as”): the programme provides for appropriate tests in line with Article 4(2), and a named test is required where another provision says so, as paragraph 2 does for vulnerability assessments and Article 26 does for threat-led penetration testing. And the list is broader than technical scanning, including physical security reviews and questionnaires, so a programme should not be assumed to be only technical.
What is in the packs for this
Each one helps with this requirement.
- Excel
DORA Article-to-Control Mapping Library
in DORA ICT Risk & Resilience ReadinessRequirement Library rows RQ-34, RQ-35, RQ-36: A range of tests; Microenterprises: risk-based testing; Vulnerability assessments before deployment. Each gives the provision in plain words, what to show and the documents that help. - Excel
DORA Readiness Self-Assessment
in DORA ICT Risk & Resilience ReadinessReadiness items RT-01: A risk-based resilience testing programme. Each rates how ready the entity is, with the evidence and the gap. - Excel
Digital Operational Resilience Testing Programme
in DORA ICT Risk & Resilience ReadinessThe test types table lists twelve kinds of test (DT-01 to DT-12) and counts those planned or recorded, including microenterprise and depository or counterparty variations. - Excel
DORA Documentation & Evidence Checklist
in DORA ICT Risk & Resilience ReadinessEvidence records EV-21: The approved testing programme. Each lists the records a supervisor can ask for. - Word
Tabletop Exercise Design Methodology
in Cyber Incident Exercises & Tabletop Scenario LibraryDescribes the tabletop as a scenario-based test.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.