Recital 20 Duration of the red team test phase

To enable testers to conduct a realistic and comprehensive testing in which all attack phases are executed and flagsare key objectives in the ICT systems supporting critical or important functions of a financial entity that the testers try to achieve through the test; are reached, sufficient time should be allocated to the active red teammeans the testers, internal or external, contracted for, or assigned to, a TLPT; testing phase. On the basis of the experience gathered with the TIBER-EU framework, the time allocated should be at least 12 weeks and should be determined taking into account the number of parties involved, the TLPT scope, the resources of the involved financial entity or entities, any external requirements, and the availability of supporting information supplied by the financial entity.