NIST CSF 2.0, IdentifyID.IM-02

If you are identified under DORA Article 26(8), carry out the advanced threat-led penetration testing that Articles 26(1) to (6) and (8) and 27 require (Section 7(1)(5)).

Include in the ICT business continuity policy the objectives, scope, timeframe, activation and deactivation criteria, governance and recovery objectives set out in Article 24(1). If you are a central counterparty, set a maximum recovery time for your critical functions of not longer than 2 hours. If you are a central securities depository, ensure a recovery time objective of not longer than 2 hours for your critical or important functions. If you are a trading venue, ensure that trading can be resumed within or close to 2 hours of a disruptive incident and that the maximum amount of data lost is close to zero (Article 24(2) to (4)). Test the plans on scenarios that simulate potential disruptions, including severe but plausible scenarios, include the ICT services provided by ICT third-party service providers where applicable, document the results, and report identified deficiencies to the management body (Article 25).

Unless you are a microenterprise, establish, maintain and review a sound and comprehensive digital operational resilience testing program as an integral part of your ICT risk-management framework, follow a risk-based approach that takes account of the evolving landscape of ICT risk and the criticality of your information assets and services, and ensure that tests are undertaken by independent parties, internal or external, with sufficient resources and no conflict of interest where the tester is internal (Article 24(1) to (4)).

Unless you are a microenterprise, establish procedures and policies to prioritize, classify and remedy all issues the tests reveal, set up internal validation methodologies to ascertain that all identified weaknesses, deficiencies or gaps are fully addressed, and ensure at least yearly that appropriate tests are conducted on all ICT systems and applications supporting critical or important functions (Article 24(5) and (6)).

Put in place a comprehensive ICT business continuity policy and ICT response and recovery plans, and conduct a business impact analysis of your exposures to severe business disruptions. Test the continuity and the response and recovery plans at least yearly and on substantive changes to systems supporting critical or important functions, and test your crisis communication plans. Keep readily accessible records of activities before and during disruption events. Unless you are a microenterprise, include cyber-attack and switchover scenarios in the tests, have a crisis management function, and report to your competent authority on request an estimate of the aggregated annual costs and losses caused by major ICT-related incidents (Article 11).

The Department says you should consider whether your logging and security event alerting capabilities are sufficient to address heightened threats, and review and test your threat-relevant operational resilience procedures, which may require more frequent use as AI-enabled cyber capabilities evolve.

The Department says you should consider testing the integrity, immutability and restorability of backups, including validation of recovery time objectives, and reviewing and testing threat-relevant operational resilience procedures, such as incident response and business continuity plans, to protect and restore critical functions, information systems and nonpublic information.

Test your incident response and business continuity and disaster recovery plans with all staff and management critical to the response, and your ability to restore critical data and information systems from backups, periodically and at least annually, and revise the plans as necessary.

Give the competent authority and your clients information that is complete, true, current, clear, objective and lawful, and cooperate with the authorities in crisis-management and contingency exercises that involve cyber-attack scenarios (Article 10(1)(a) and (b)).

If the Finansinspektionen designates you to carry out threat-led penetration tests under DORA Article 26, carry them out as often as it decides, and give the Riksbank the information it requests for its oversight and coordination of the tests (chapter 2, sections 1 and 4).

At the high tier, conduct a data security risk assessment and a penetration test of the database's systems at least once every 18 months, and hold a quarterly internal discussion of security incidents.