Testing under DORA outside the TLPT regime: penetration and security testing every entity needs, lighter testing for small firms, testing that involves ICT providers, and remediating what tests find.
The testing every DORA entity owes, whether or not it is picked for TLPT: the Article 25 test types, yearly tests of systems supporting critical or important functions, independence of testers, security testing of internet-exposed systems and remediation.
What testing smaller entities must do under DORA: the risk-based approach for microenterprises, the security testing plan in the simplified framework, yearly backup and restore tests, and exclusion from TLPT.
How providers take part in a financial entity's testing: TLPT participation clauses, pooled tests for shared providers, joint group tests, provider failure scenarios in continuity tests and verifying providers' vulnerability handling.
What DORA requires after testing: prioritising and fixing every issue, validating remediation, following up audit findings, feeding lessons into risk assessment, reporting continuity test deficiencies to the board and TLPT remediation plan deadlines.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.