Annex V Content of the red team test report (Article 12(2))

the targeted critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; and identified ICT systems, processes and technologies supporting the critical or important function means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;, as identified in the red team test plan;

summary of each scenario;

flags reached and not reached;

attack paths followed successfully and unsuccessfully;

tactics, techniques and procedures used successfully and unsuccessfully;

deviations from the red team test plan, if any;

leg-ups granted, if any;

vulnerability means a weakness, susceptibility or flaw of a product with digital elements that can be exploited by a cyber threat; and other finding description including their criticality;

root cause analysis of successful attacks;

recommendations for remediation including indication of the remediation priority.