Art.24 General requirements for the performance of digital operational resilience testing
Financial entities other than microenterprises set up, keep and periodically review a robust, comprehensive programme of digital operational resilience testing within the ICT risk management framework, applied proportionately under Article 4(2), to assess incident preparedness, find weaknesses and fix them promptly. For those entities the programme follows a risk-based approach reflecting the evolving ICT risk landscape, specific risks and the criticality of assets and services; tests are run by independent internal or external parties (internal testers need sufficient resources and no conflicts of interest); issues found are prioritised, classified and remedied with internal validation that they are closed; and appropriate tests are run at least yearly on every ICT system and application that supports a critical or important function (Art. 24(3) to (6)). Microenterprises are outside these paragraphs and test under Article 25(3), balancing testing resources and time against urgency, risk type and criticality. Entities identified by their competent authority must add TLPT under Article 26.
Source: DORA (Regulation (EU) 2022/2554), Art.24. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open DORA (Regulation (EU) 2022/2554) in the compliance library.
Applies to the financial entities listed in Article 2. Many duties are lighter or absent for microenterprises and for the entities in Article 16(1); each statement says where. Article 19 carries the reporting clocks of Delegated Regulation (EU) 2025/301, Article 5.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Issue log from tests with priority, classification, remediation owner and validation of closure · SIEM / log platform
periodic reviewEvidence produced at each review
- Tester independence records, including conflict-of-interest checks for internal testers · Document repository
- Yearly test schedule and results covering every ICT system and application that supports a critical or important function · Document repository
governing documentDocuments that govern the control
- Approved digital operational resilience testing programme with its risk-based rationale (entities other than microenterprises) · Document repository
- For a microenterprise: its strategic ICT test plan under Article 25(3) · Policy repository / GRC workspace
First move
Common gaps auditors find
- Testing done by the team that built or runs the system
- Findings closed without validation
- Some systems supporting critical or important functions missed in the yearly cycle
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.23 Operational or security payment-related incidents · Art.25 Testing of ICT tools and systems