Article 22 Digital Operational Resilience Act (DORA), Testing of ICT Tools And Systems

Article 22 of the Digital Operational Resilience Act (DORA) is a crucial component of the regulation, aimed at ensuring that financial entities within the European Union maintain robust digital operational resilience. This article focuses on the comprehensive testing of Information and Communication Technology (ICT) tools and systems, which are critical to the functioning of financial entities. Through this article, DORA mandates a rigorous testing regime that encompasses various methods to identify, assess, and mitigate potential vulnerabilities within ICT systems.

Comprehensive Testing Programme For ICT Resilience

The Digital Operational Resilience Testing Programme, as outlined in Article 21 of DORA, serves as the framework under which the testing of ICT tools and systems is carried out. Article 22 further specifies the scope and types of tests that financial entities are required to conduct. The goal is to ensure that all ICT tools and systems are thoroughly vetted for vulnerabilities, compatibility issues, performance challenges, and other potential risks that could compromise the entity's digital resilience.

The testing programme must include a wide array of testing methods, each tailored to address specific aspects of ICT resilience:

Vulnerability assessments and scans are essential for identifying weaknesses in ICT systems that could be exploited by malicious actors. By conducting regular scans, financial entities can stay ahead of potential threats and take proactive measures to address any issues that arise.

As many financial entities rely on open-source software, it is crucial to assess the security of these tools through open source analyses. These analyses help identify vulnerabilities within the code, ensuring that the software is secure and reliable.

Network security assessments are vital for ensuring the overall digital resilience of a financial entity. These assessments identify and mitigate risks within the network infrastructure, ensuring that data flows securely and that the network is protected against both external and internal threats.

Gap analyses involve comparing the current state of ICT systems with the desired state as defined by industry standards and regulatory requirements. This process helps identify areas where systems fall short and provides a roadmap for achieving full compliance and operational efficiency.

While digital resilience often focuses on cybersecurity, the physical security of ICT infrastructure is equally important. Physical security reviews assess the protection of data centers, servers, and other critical infrastructure components against physical threats such as unauthorized access or environmental hazards.

Questionnaires and scanning software solutions are used to gather information about the current state of ICT systems and identify potential areas of concern. Questionnaires help understand how systems are used and managed, while scanning software automates the process of identifying vulnerabilities and other issues.

Source code reviews are required to ensure that the software powering critical functions is free from vulnerabilities and adheres to secure coding practices.

Scenario-based tests simulate real-world scenarios, such as cyberattacks or system failures, to assess how well ICT systems can withstand and recover from such events. These tests are crucial for identifying weaknesses that may not be apparent in routine operations.

Compatibility testing ensures that various software and hardware tools used by financial entities interact seamlessly, preventing issues that could arise from conflicts between different systems.

Performance testing measures how well ICT systems perform under various conditions, ensuring that they can handle business demands without compromising speed or reliability.

End-to-end testing examines the entire ICT system from start to finish, ensuring that all components work together as intended and that the system as a whole is resilient against potential threats.

Penetration testing, often referred to as ethical hacking, involves simulating cyberattacks to identify and exploit vulnerabilities within ICT systems. This type of testing is crucial for understanding how an actual attack might occur and for strengthening defenses against such threats.

Mandatory Vulnerability Assessments for Critical Functions

In addition to the broad range of tests outlined in the first paragraph, Article 22 also mandates specific testing requirements for certain financial entities. Those referred to in points (f) and (g) of Article 2(1) of DORA are required to conduct vulnerability assessments before any deployment or redeployment of new or existing services that support critical functions, applications, and infrastructure components.

These vulnerability assessments are crucial in ensuring that any changes or updates to critical ICT systems do not introduce new risks or vulnerabilities. By performing these assessments before deployment, financial entities can identify and address potential issues before they impact operations, thereby maintaining the integrity and resilience of their critical functions.

Conclusion

Article 22 of DORA emphasizes the importance of rigorous and comprehensive testing of ICT tools and systems within financial entities. By mandating a wide range of testing methods, DORA aims to ensure that these entities can identify and mitigate potential vulnerabilities, ensuring their digital operational resilience. The mandatory vulnerability assessments for critical functions further underscore the importance of proactive risk management in maintaining the stability and security of the EU's financial sector.