Article 25 Testing of ICT tools and systems
TL;DR
The Digital Operations Resilience Act provides criteria for testing the operational resilience of digital services of financial entities such as Central Securities Depositories and Central Counterparties. This includes vulnerability assessments and scans, open source analysis, network security assessments, gap analyses, physical security reviews, questionnaires, scanning solutions, source code reviews, scenario tests, compatibility tests, performance tests, end-to-end tests, and penetration testing. Microenterprises must use a risk-based approach combined with strategic planning for ICT testing, taking into account the urgency, type of risk, criticality of information, and services provided as well as any other relevant factors.-
The digital operational resilience testingas defined in Article 24 programme referred to in Article 24 shall provide, in accordance with the criteria set out in Article 4(2), for the execution of appropriate tests, such as vulnerabilitymeans a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning software solutions, source code reviews where feasible, scenario-based tests, compatibility testing, performance testing, end-to-end testing and penetration testing.
proportionality Paragraph allows for application of the proportionality principle according to Article 4. -
Central securities depositoriesmeans a central securities depository as defined in Article 2(1), point (1), of Regulation (EU) No 909/2014; and central counterpartiesmeans a central counterparty as defined in Article 2, point (1), of Regulation (EU) No 648/2012; shall perform vulnerabilitymeans a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; assessments before any deployment or redeployment of new or existing applications and infrastructure components, and ICT servicesmeans digital and data services provided through ICT systems to one or more internal or external users on an ongoing basis, including hardware as a service and hardware services which includes the provision of technical support via software or firmware updates by the hardware provider, excluding traditional analogue telephone services; supporting critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; of the financial entity.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.COIF Paragraph has special considerations for 'critical or important functions' as defined by Article 3 point 22. -
Microenterprisesmeans a financial entity, other than a trading venue, a central counterparty, a trade repository or a central securities depository, which employs fewer than 10 persons and has an annual turnover and/or annual balance sheet total that does not exceed EUR 2 million; shall perform the tests referred to in paragraph 1 by combining a risk-based approach with a strategic planning of ICT testing, by duly considering the need to maintain a balanced approach between the scale of resources and the time to be allocated to the ICT testing provided for in this Article, on the one hand, and the urgency, type of risk, criticality of information assetsmeans a collection of information, either tangible or intangible, that is worth protecting; and of services provided, as well as any other relevant factor, including the financial entity’s ability to take calculated risks, on the other hand.
exemption Paragraph has a reduced scope, i.e., it does not apply to all financial entities in Article 2(1) but some or only those of a certain size.