What it asks for. Financial entities identified by their competent authority must carry out threat-led penetration testing at least every three years, unless the authority sets a different frequency. Each test covers several or all critical or important functions and is performed on live production systems.
In practice. The financial entity identifies the relevant ICT systems, processes and technologies supporting critical or important functions, including those outsourced, and the competent authority validates the scope. Where ICT third-party service providers are in scope, the entity ensures they participate, and pooled testing can be used where a provider serves several entities. Testing follows the regulatory technical standards, which align with the TIBER-EU framework, and includes threat intelligence, red teaming and controlled risk management. At the end, the entity and testers provide a summary of findings, remediation plans and documentation, and the authority issues an attestation that the test was performed in line with the requirements. Remediation must then be tracked to closure.
Common gaps. Gaps include weak risk management around testing in production, poor engagement with third-party providers, and remediation plans that are agreed but not followed through.