Testing of ICT business continuity plans under DORA Article 11(6) must use the BIA and ICT risk assessment and show whether critical or important functions can continue. Tests must use scenarios simulating disruptions, including severe but plausible ones and always those used to build the plans; include services from ICT third-party providers where relevant, considering provider insolvency, failure and political risk; for entities other than microenterprises include switchover to redundant capacity, backups and facilities, checking critical functions run for a sufficient period and normal service can be restored; challenge plan assumptions including governance and crisis communication; and verify that staff, providers, systems and services respond adequately. CCPs and CSDs must involve members, users, providers and interdependent institutions. Results must be documented and deficiencies analysed, fixed and reported to the management body.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.