Article 25
Testing of ICT tools and systems
TL;DR
The Digital Operations Resilience Act provides criteria for testing the operational resilience of digital services of financial entities such as Central Securities Depositories and Central Counterparties. This includes vulnerability assessments and scans, open source analysis, network security assessments, gap analyses, physical security reviews, questionnaires, scanning solutions, source code reviews, scenario tests, compatibility tests, performance tests, end-to-end tests, and penetration testing. Microenterprises must use a risk-based approach combined with strategic planning for ICT testing, taking into account the urgency, type of risk, criticality of information, and services provided as well as any other relevant factors.-
The digital operational resilience testingas defined in Article 24 programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerabilitya weakness, susceptibility or flaw of an asset, system, process or control that can be exploited assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
proportionality Paragraph allows for application of the proportionality principle according to Article 4. -
Central securities depositoriesa central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014 and central counterpartiesa central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012 shall perform vulnerabilitya weakness, susceptibility or flaw of an asset, system, process or control that can be exploited assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT servicesdigital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services supporting critical or important functionsa function the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law of the financial entity.
COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22.exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size. -
Microenterprisesa financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million shall perform the tests referred to in paragraph 1 by combining a risk- based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of information assetsa collection of information, either tangible or intangible, that is worth protecting and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks, on the other hand.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.