Q23. What do regulators actually expect to see in operational resilience testing—and how is it assessed?

Regulators have moved beyond policy review to evidence of operational capability. They expect scenario-based testing—ransomware, major vendor failure, payment system outage—with documented playbooks, defined recovery time objectives, and clear communication protocols. Quarterly testing cycles are becoming standard. Under DORA, regulators can mandate threat-led penetration testing (TLPT) of critical systems. The assessment criterion is whether the firm can actually demonstrate recovery under observed conditions, not whether it has a plan that says it can.