DORA Chapter IV: the testing programme, basic testing of ICT tools and systems, threat-led penetration testing and requirements for testers.
The risk-based testing programme every entity other than a microenterprise must run: independence of testers, remediation and validation of findings, and the yearly testing of all systems and applications supporting critical or important functions.
The menu of tests DORA expects in a testing programme, from vulnerability scans and source code review to scenario, performance and penetration tests, plus pre-deployment assessments for CSDs and CCPs and the approach for microenterprises.
Advanced testing of ICT tools, systems and processes based on threat-led penetration testing: who must run it, scope, testers, third-party providers, results and the supervisory attestation.
Who may carry out threat-led penetration testing: suitability, expertise, certification or codes of conduct, assurance and insurance for testers, the extra conditions for internal testers, and the experience and reference minimums set by the TLPT RTS.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.