Article 24
General requirements for the performance of digital operational resilience testing
TL;DR
The European Union's Digital Operations Resilience Act aims to enable financial entities, other than microenterprises, to assess their preparedness for handling ICT-related incidents and identify weaknesses, deficiencies, and gaps in digital operational resilience. To achieve this, entities must establish and maintain a sound and comprehensive digital operational resilience testing programme, including a range of assessments, tests, methodologies and tools; and approach it in a risk-based manner. To ensure independence, tests must be conducted by an independent internal or external party, with sufficient resources and avoidance of conflicts of interest. Additionally, procedures must be set up to prioritise, classify, and remedy all issues identified, with yearly tests conducted on all ICT systems and applications.-
For the purpose of assessing preparedness for handling ICT-related incidentsa single event or a series of linked events unplanned by the financial entity that compromises the security of the network and information systems, and have an adverse impact on the availability, authenticity, integrity or confidentiality of data, or on the services provided by the financial entity, of identifying weaknesses, deficiencies and gaps in digital operational resiliencethe ability of a financial entity to build, assure and review its operational integrity and reliability by ensuring, either directly or indirectly through the use of services provided by ICT third-party service providers, the full range of ICT-related capabilities needed to address the security of the network and information systems which a financial entity uses, and which support the continued provision of financial services and their quality, including throughout disruptions, and of promptly implementing corrective measures, financial entitiesas defined in Article 2, points (a) to (t), other than microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testingas defined in Article 24 programme as an integral part of the ICT risk-management framework referred to in Article 6.
proportionality Paragraph allows for application of the proportionality principle according to Article 4.exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size. -
When conducting the digital operational resilience testingas defined in Article 24 programme referred to in paragraph 1 of this Article, financial entitiesas defined in Article 2, points (a) to (t), other than microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million, shall follow a risk-based approach taking into account the criteria set out in Article 4(2) duly considering the evolving landscape of ICT riskany reasonably identifiable circumstance in relation to the use of network and information systems which, if materialised, may compromise the security of the network and information systems, of any technology dependent tool or process, of operations and processes, or of the provision of services by producing adverse effects in the digital or physical environment, any specific risks to which the financial entity concerned is or might be exposed, the criticality of information assetsa collection of information, either tangible or intangible, that is worth protecting and of services provided, as well as any other factor the financial entity deems appropriate.
proportionality Paragraph allows for application of the proportionality principle according to Article 4.exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size. -
Financial entitiesas defined in Article 2, points (a) to (t), other than microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million, shall ensure that tests are undertaken by independent parties, whether internal or external. Where tests are undertaken by an internal tester, financial entitiesas defined in Article 2, points (a) to (t) shall dedicate sufficient resources and ensure that conflicts of interest are avoided throughout the design and execution phases of the test.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size. -
Financial entitiesas defined in Article 2, points (a) to (t), other than microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million, shall establish procedures and policies to prioritise, classify and remedy all issues revealed throughout the performance of the tests and shall establish internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size. -
Financial entitiesas defined in Article 2, points (a) to (t), other than microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million, shall ensure, at least yearly, that appropriate tests are conducted on all ICT systems and applications supporting critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.