Art. 6 Risk management for pooled or joint TLPTs | RTS on threat-led penetration testing | DORA

This article addresses a specific scenario that arises out of the broader TLPT framework: what happens when multiple financial entities are involved in the same test, either through a joint TLPT or a pooled TLPT.

It establishes that while each financial entity retains individual responsibility for its own risk assessment and risk management measures, there is also a collective layer of risk management that must be addressed.

The designated lead financial entity takes on the additional responsibility of assessing the risks that arise from the multi-entity nature of the test, and all involved control teams are required to cooperate with it to identify risks that span across the group.

Important points:

Each financial entity in a joint or pooled TLPT must conduct its own independent risk assessment and establish its own risk management measures.
The control team of the designated lead financial entity is responsible for assessing the risks specific to having multiple financial entities involved in the same TLPT.
All other control teams involved in the test are required to cooperate with the designated lead financial entity's control team to identify potential joint risks.

There are inherent elements of risks associated with TLPT as critical functions are tested in a live production environment, with the possibility of causing denial-of-service incidents, unexpected system crashes, damages to critical live production systems, or the loss, modification, or disclosure of data. Those risks highlight the need for robust risk management measures. To ensure that the TLPT is conducted in a controlled manner all along the testing, it is very important that financial entities are at all points aware of the particular risks that arise in a TLPT and that those risk are mitigated. In that respect, without prejudice to the internal processes of the financial entity and the responsibility and delegations already provided to the control team lead, information about the TLPT risk management measures, or, in particular cases the approval of those risk management measures by the financial entity’s management body itself, may be appropriate. To be able to deliver effective and most qualified professional services and to reduce those risks, it is also essential that the testers and threat intelligence providers (together, the TLPT providers) have the highest level of skills, expertise, and an appropriate experience in threat intelligence and TLPT in the financial services industry.

Article 6 Risk management for pooled or joint TLPTs

Relevant recitals