Article 7 Selection of TLPT providers

1. the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider and external testers provide the control teammeans the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; with a detailed curriculum vitae and copies of certifications that, according to recognised market standards, are appropriate for the performance of their activities;

2. the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider and external tester are duly and fully covered by proper professional indemnity insurances including against risks of misconduct and negligence;

3. the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider provides at least three references from previous assignments in the context of penetration testing and red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

4. the external testers provide at least five references from previous assignments related to penetration testing and red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

5. the staff of the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider assigned to the TLPT:

   1. is composed of at least a manager with at least 5 years’ experience in threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; and at least one additional member with at least 2 years’ experience in threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations;;

   2. display a broad range and appropriate level of professional knowledge and skills, including:

      1. intelligence gathering tactics, techniques and procedures;

      2. geopolitical, technical and sectorial knowledge;

      3. adequate communication skills to clearly present and report on the result of the engagement;

   3. has a combined participation in at least three previous assignments in threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; in the context of penetration testing and red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

   4. does not simultaneously perform any blue team tasksmeans tasks that are typically carried out by the blue team such as security operation centre (SOC), ICT infrastructure services, helpdesk services, incident management services at operational level; or other services that may present a conflict of interest with respect to the financial entity, ICT third-party service providermeans an undertaking providing ICT services; or an ICT intra-group service providermeans an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control; involved in TLPT to which they are assigned;

   5. is separated from and not reporting to staff of the same TLPT provider providing external testers for the same TLPT;

6. for external testers, the red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; assigned to the TLPT:

   1. is composed of at least a manager, with at least 5 years of experience in penetration testing and red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing as well as at least two additional testers, each with penetration testing and red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing of at least 2 years;

   2. displays a broad range and appropriate level of professional knowledge and skills, including knowledge about the business of the financial entity, reconnaissance, risk management, exploit development, physical penetration, social engineering, vulnerabilitymeans a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; analysis, as well as adequate communication skills to clearly present and report on the result of the engagement;

   3. has a combined participation in at least five previous assignments related to penetration testing and red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

   4. is not employed by, nor provides services to, a threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider that simultaneously performs blue team tasksmeans tasks that are typically carried out by the blue team such as security operation centre (SOC), ICT infrastructure services, helpdesk services, incident management services at operational level; for either a financial entity, an ICT third-party service providermeans an undertaking providing ICT services;, or an ICT intra-group service providermeans an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control; that is involved in the TLPT;

   5. is separated from any staff of the same TLPT provider that simultaneously provides threat-intelligence services for the same TLPT;

7. the testers and the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider carry out restoration procedures at the end of testing, including secure deletion of information related to passwords, credentials, and other secret keys compromised during the TLPT, secure communication to the financial entities of the accounts compromised, secure collection, storage, management, and disposal of other data collected during testing;

8. testers, in addition to the restoration procedures at the end of testing as referred to in point (g), carry out the following restoration procedures:

   1. command and control deactivation;

   2. scope and date kill switches;

   3. removal of backdoors and other malware;

   4. potential breach notification;

   5. procedures for future back-up restoration which may concern malware or tools installed during the test;

   6. monitoring of the blue teammeans the staff of the financial entity and, where relevant, staff of the financial entity’s third-party service providers and any other party deemed relevant in consideration of the scope of the TLPT, of the financial entity’s third-party service providers, that are defending a financial entity's use of network and information systems by maintaining its security posture against simulated or real attacks and that is not aware of the TLPT; activities and informing the control teammeans the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; of any possible detections;

9. testers and the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider do not perform, or participate in, any of the following activities:

   1. unauthorised destruction of equipment of the financial entity and of its ICT third-party service providersmeans an undertaking providing ICT services;, if any;

   2. uncontrolled modification of information and ICT assetsmeans a software or hardware asset in the network and information systems used by the financial entity; of the financial entity and of its ICT third-party service providersmeans an undertaking providing ICT services;, if any;

   3. intentionally compromising the continuity of critical or important functionsmeans a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; of the financial entity;

   4. unauthorised inclusion of out-of-scope systems;

   5. unauthorised disclosure of test results.

The control teammeans the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; shall keep record of the documentation provided by the testers and the threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; providers to evidence compliance with paragraph 1, points (a) to (f).

In exceptional circumstances, financial entities may contract external testers and threat intelligencemeans information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; providers that do not meet one or more of the requirements set out in paragraph 1, points (a) to (f), provided that those financial entities adopt measures that are appropriate to mitigate the risks relating to the lack of compliance with such points and record those measures.