Article 11Note: This article is based on the final draft from the ESAs and is not yet adopted. Closure phase
-
Following the end of the active red team testing phase, the control team lead shall inform the blue team that a TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems took place.
-
Within four weeks from the end of the active red team testing phase, the testers shall submit to the control team a red team test report containing the information set out in Annex V.
-
Without undue delay, the control team shall provide the red team test report to the blue team and test managers.
At the request of the test managers, the report referred to in the first subparagraph of this paragraph shall not contain sensitive information.
-
Upon receipt of the red team test report, and no later than ten weeks after the end of the active red team testing phase, the blue team shall submit to the control team a blue team test report containing the information set out in Annex VI. Without undue delay, the control team shall provide the blue team test report to the testers and the test managers.
At the request of the test managers, the report referred to in the first subparagraph of this paragraph shall not contain sensitive information.
-
No later than ten weeks after the end of the active red team testing phase, the blue team and the testers shall carry out a replay of the offensive and defensive actions performed during the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems. The control team shall also conduct a purple teaming exercise on topics jointly identified by the blue team and the testers, based on vulnerabilitiesa weakness, susceptibility or flaw of an asset, system, process or control that can be exploited identified during the test and, where relevant, on issues that could not be tested during the active red team testing phase.
-
After completion of the replay and purple teaming exercises, the control team, the blue team, the testers and threat intelligenceinformation that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations providers shall provide feedback to each other on the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems process. The test managers may provide feedback.
-
Once the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems authority has notified the control team lead that it has assessed that the blue team test report and the red team test report contain the information set out in Annex V and Annex VI, the financial entity shall within eight weeks submit the report summarizing the relevant findings of the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems referred to in Article 26(6) of Regulation (EU) 2022/2554, containing the elements set out in Annex VII for approval.
At the request of the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems authority, the report referred to in the first subparagraph of this paragraph shall not contain sensitive information.