[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F25":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","25","Article 25","Testing of ICT tools and systems",0,"Digital Operational Resilience Act","**What it asks for.** Article 25 lists the types of tests the resilience testing programme should include, such as vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, source code reviews where feasible, scenario based tests, performance and end to end testing, and penetration testing.\n\n**In practice.** The entity chooses tests appropriate to each system's criticality and runs regular vulnerability scanning with defined remediation timelines alongside deeper assessments. Results feed the ICT risk framework. Evidence includes test schedules, scan and assessment reports and remediation metrics.\n\n**Common gaps.** Programmes often rely on scanning alone and omit scenario based or end to end tests. Source code reviews and physical security reviews are frequently overlooked.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_25","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]