Skip to main content
CMDashCybersecurity Maturity Dashboard

Art.26(1) Advanced TLPT testing

DORA · 2022/2554

1. Financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, which are identified in accordance with paragraph 8, third subparagraph, of this Article, shall carry out at least every 3 years advanced testing by means of TLPT. Based on the risk profile of the financial entity and taking into account operational circumstances, the competent authority may, where necessary, request the financial entity to reduce or increase this frequency.

Quoted verbatim from Regulation (EU) 2022/2554 (DORA), which is in the public domain.

No cross-framework mapping is seeded for this control. That is stated rather than filled in: a mapping nobody authored is worse than a gap you can see.

These connectors produce data relevant to DORA’s Resilience Testing family, which is the granularity CMDash publishes — there is no pre-built per-control mapping, and claiming one would be inventing it. You decide which evidence answers which control.

Track Art.26(1) with evidence behind it

In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.

Art.26(1) Advanced TLPT testing — DORA | CMDash