Digital Operational Resilience Testing
How DORA testing checks whether the systems behind critical financial services would actually hold up in a real disruption, and what a credible test result looks like.
Line 07: Digital operational resilience testing
Testing whether resilience works before a real disruption tests it: proportionate testing programmes, from tabletop work to live exercises.
The line guide
Working guides on this line
End-to-End Testing of a Service
How end-to-end testing follows a complete customer journey across every system, team, and supplier it touches, rather than testing each part in isolation.
Network Security Testing
How network security testing checks the paths into and between a firm's systems, and why segmentation and supplier connections deserve the closest attention.
Performance and Load Testing
Why a system that works well for a handful of users can still fail at peak demand, and how load testing finds that breaking point before customers do.
Proportionate Testing Programmes
Why a DORA testing programme should grow with risk, complexity, and scale, and how a smaller firm can still test the systems its critical functions depend on.
Scenario-Based Testing
How scenario-based testing rehearses a severe but plausible disruption from first failure to recovery, and why the scenario must stress decisions as well as technology.
Testing After Major Change
Why the period after a major change is when resilience is most at risk, and how testing before, during, and after the change reduces that risk for critical services.
Testing Findings and Remediation
How testing findings become real improvements through ownership, prioritisation, and retesting, and why an unowned finding is the same as an undiscovered weakness.
Testing for Small Entities
How a small financial entity tests proportionately, using supplier evidence well, focusing on its critical functions, and avoiding a programme it cannot sustain.
Vulnerability Scanning and Assessment
What vulnerability scanning and assessment reveal about a firm's ICT systems, why a clean scan is not a clean bill of health, and how findings become fixes.