Glossary term
Operational Resilience Testing
Also: Digital Operational Resilience Testing, DORA Art. 24-27
Mandatory testing programme under DORA Art. 24-27 for the operational resilience of financial entities' ICT systems. Covers vulnerability assessments, open-source analyses, network security reviews, gap analyses, physical security reviews, questionnaires, scans, penetration tests and TLPT.
DORA demands an annual testing programme proportional to the size, risk profile and complexity of the financial entity. The programme must define test methods, frequency, scope, acceptance criteria, escalation paths, reporting and remediation discipline. Results feed the annual ICT risk report to the supervisor.
Test spectrum: vulnerability assessments at least yearly, source-code reviews for critical applications, penetration tests for external and critical internal systems, network security assessments, performance and end-to-end tests. Significant entities additionally need TLPT at least every three years (Art. 26-27).
In practice
Audit logic: the testing programme must be steered by an independent function inside or outside the entity. Testers must not concurrently be developers or operators of the tested systems. Evidence duty: every test needs minutes, findings list, risk rating, remediation plan, retest.
Related terms
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
TLPT (Threat-Led Penetration Testing)
Ein behördlich begleiteter, intelligenz-gesteuerter Penetrationstest, den DORA für signifikante Finanzunternehmen alle drei Jahre fordert. TLPT folgt dem TIBER-EU-Framework und ist deutlich intensiver als ein klassischer Pentest.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.