Contact · DORA threat-led testing
Request the evidence pack. Article 27, in one send.
The documents your authority will ask for before a tester is appointed. Tell us who you answer to and when the test falls, and the pack comes back with a proposal that fits.
What is in it
- Art. 27(1)(a)Named operators, vetting status and references from regulated engagements
- Art. 27(1)(b)Threat intelligence, penetration testing and red team track record
- Art. 27(1)(c)CREST accreditation and tester certifications per role
- Art. 27(1)(d)Independent assurance on how test risk, data and tooling are managed
- Art. 27(1)(e)Professional indemnity certificate, including misconduct and negligence
- Art. 26(8)The independent threat intelligence provider and their separation from the red team
Your authority may ask for more, such as individual background checks or a conflict-of-interest declaration. Say so in the form and it goes in the same send.