Digital operational resilience testing and ICT third-party risk management
This domain tests the design of a risk-based testing programme, threat-led penetration testing, and the DORA requirements for managing ICT third-party dependencies.
Core rules and concepts
- Financial entities must run a proportionate digital operational resilience testing programme, with critical ICT systems tested at least annually.
- Threat-led penetration testing (TLPT) is required at least every three years for significant entities, excluding small and micro enterprises, and must use independent external testers. It is not a vulnerability scan.
- Third-party risk management requires due diligence, a maintained register of information reported to the competent authority at least annually, contract clauses covering service levels, data location, access and audit rights, subcontracting, business continuity, termination and exit, and cooperation with authorities.
- Concentration risk and exit strategies must be assessed, especially for critical functions. Designated CTPPs are subject to the ESAs' oversight framework.
Worked example
A bank depends on one cloud provider for core banking. The provider passes due diligence, but the bank identifies high concentration and weak exit provisions. The correct response is not simply to accept the risk because the provider is reputable. The bank must assess substitutability, define an exit strategy, strengthen contractual termination support and report the dependency through the register. Reasoning: DORA regulates the entity's managed dependency, not only provider selection.
Traps that cost marks
- Treating TLPT as routine scanning or generic red teaming without threat intelligence and independence.
- Keeping a static register or treating it as a procurement inventory.
- Assuming a strong contract removes concentration risk or the need for an exit plan.
- Forgetting that critical-function providers need enhanced oversight and testing coverage.