Threat-led penetration test with an excluded cloud dependency
Vantage Bank is an EU credit institution with €40bn in assets and critical payment, lending and custody functions. Its competent authority has designated it to perform threat-led penetration testing (TLPT). Its last full TLPT was in 2022. For the 2025 cycle, the CISO proposes that the internal red team, which reports to the CISO, will run the test; scope will be only the online banking web front end in production; the cloud provider hosting the payment API will be excluded because its contract forbids testing; no external threat intelligence will be used; testing will occur during business hours; and the business lines will not be told until the report is issued. The internal red team has five staff, two of whom also administer the production firewalls. The board is told the plan saves €400,000 and meets the three-year cycle.
1. Assess whether the proposed 2025 TLPT plan satisfies DORA requirements. Address independence, scope, timing and threat intelligence.
Read the worked answer
Independence. The plan is weak. The red team reports to the CISO, who owns the ICT controls being tested, and two testers administer production firewalls. That creates a self-review and operational conflict. DORA requires independent testers, whether internal or external; the testers must not be in a position to approve or operate the controls they are testing. Reporting should sit outside the ICT operations line, for example to the audit committee or a board risk committee, with quality assurance over the test.
Scope. Testing only the online banking web front end is too narrow. TLPT must cover critical or important functions and the systems that support them. Payment, lending and custody are critical here. The payment API and its cloud dependency are in scope if they support a critical function. Excluding the cloud provider because the contract forbids testing is not a valid scope decision; it is a contract and access problem that must be escalated.
Timing and intelligence. A test every three years is the baseline, so 2025 is within the cycle, but the plan must be risk-based and use current threat intelligence. No external threat intelligence makes the test less realistic. Business-hours testing may be a safety choice, but it can reduce realism and should be justified. The €400,000 saving is irrelevant if the test does not provide credible assurance.
2. What should Vantage do about the cloud provider's refusal to allow testing of the payment API?
Read the worked answer
Vantage should first check the contract and the provider's standard testing terms. DORA expects contracts for critical services to include access, audit and cooperation rights, including cooperation with TLPT where relevant. If the contract is silent or refuses testing, Vantage should negotiate a testing protocol with the provider: scope, notice, safety constraints, data handling and supervisory access. The provider may offer its own independent test evidence, but that is not automatically a substitute for Vantage's TLPT.
If negotiation fails, Vantage should escalate the issue to the competent authority and document the risk. It should consider a pooled or coordinated test with other users of the same provider, an alternative provider for the critical function, or a documented residual risk acceptance approved by the board. It cannot simply exclude a system that supports a critical function and claim the TLPT is complete. The decision, the reasons and the mitigation should be recorded and reflected in the third-party register and exit plan.
3. How should the board oversee remediation of TLPT findings?
Read the worked answer
The board should receive the TLPT report, the management response and a remediation plan with owners, dates and risk ratings. It should ask whether findings are isolated control failures or signs of a wider weakness, and whether any finding affects a critical function. It should approve residual risk where remediation is delayed and require evidence of retesting or independent validation. The audit committee should track overdue actions, and the board should see whether the same findings recur across cycles.
The board should also oversee the contractual and scope issues, not only the technical findings. If the cloud provider blocked testing, that is a governance and third-party risk issue. The board should require a clear decision on renegotiation, alternative sourcing or time-bound acceptance, and should ensure the next TLPT cycle is not planned around the provider's convenience.