3. A SIPS operator shall establish a testing programme to regularly test the operational effectiveness of all processes, procedures and controls of the cyber resilience framework referred to in paragraphs 1 and 2. As part of this testing programme, the SIPS operator shall conduct TIBER-EU threat-led penetration tests involving the use of techniques to simulate an attack on the SIPS’s critical functions and underlying systems as set out under the TIBER-EU framework.
Where a branch is identified as a SIPS operator, the competent authority may take into account the results of a penetration test performed by the legal entity of which the branch is a legally dependent part if such penetration test can be deemed a comparable exercise to a TIBER-EU test, and if it also captures the effectiveness of the branch’s relevant controls and systems.