YTYK You think you know

Card 10 of 15 Testing — and then the hard kind ●○○ Foundational

A programme, not an annual pentest

Entities must establish a digital operational resilience testing programme as part of the ICT risk management framework: risk-based, covering a range of assessments and tests, with all ICT systems supporting critical or important functions tested at least yearly, and a process to fully address what the tests find.

Why it is like this

Testing had been an annual compliance exercise whose findings went into a register and nowhere else. Requiring a programme with remediation attached makes the output the point rather than the certificate.

Not to be confused with

One annual penetration test. The Regulation names a spread — vulnerability assessments and scans, open-source analyses, network security assessments, gap analyses, physical security reviews, questionnaires, scenario-based tests, compatibility, performance and end-to-end testing.

In practice

Tests must be carried out by independent parties, internal or external, with safeguards against conflicts of interest where the testers are internal.

Source: Regulation (EU) 2022/2554 (DORA) — Art. 24 and Art. 25. Read on .

Predict Check yourself

A firm runs one external penetration test a year on its customer portal and files the report. Does that meet Articles 24–25?

  1. No — the programme must cover a range of test types across all systems supporting critical or important functions, with findings fully addressed.
  2. Yes, provided the tester is external and independent.
  3. Yes, provided the portal is the only internet-facing system.
  4. No, because penetration testing is reserved for the threat-led regime.
Show the answer

No — the programme must cover a range of test types across all systems supporting critical or important functions, with findings fully addressed.

One test on one system is not a programme, and filing a report is not remediation. Both halves fail.