6.5.2. The relevant entities shall: (a) establish, based on the risk assessment carried out …

(a)

establish, based on the risk assessment carried out pursuant to point 2.1, the need, scope, frequency and type of security tests;

(b)

carry out security tests according to a documented test methodology, covering the components identified as relevant for secure operation in a risk analysis;

(c)

document the type, scope, time and results of the tests, including assessment of criticality and mitigating actions for each finding;

(d)

apply mitigating actions in case of critical findings.