What it asks for. Article 24 requires financial entities, other than microenterprises, to establish a sound and comprehensive digital operational resilience testing programme as part of their ICT risk management framework. Tests must be risk based, performed by independent parties, and at least yearly for ICT systems supporting critical or important functions.
In practice. The entity maintains a multi year testing programme covering the tools and methods in Article 25, prioritises systems by criticality, ensures tester independence and tracks findings to remediation. Results are reported to management. Evidence includes the testing programme, test reports, remediation tracking and independence arrangements.
Common gaps. Programmes often reuse existing penetration tests without assessing gaps in scope. Remediation of findings is not always validated.