Article 11 Testing phase: red team test

Following approval of the targeted threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; report by the TLPT authority means any of the following: the single public authority in the financial sector designated in accordance with Article 26(9) of Regulation (EU) 2022/2554; the authority in the financial sector to which the exercise of some or all of the tasks in relation to TLPT is delegated in accordance with Article 26(10) of Regulation (EU) 2022/2554; any of the competent authorities referred to in Article 46 of Regulation (EU) 2022/2554;, the testers shall prepare the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan that shall contain the information set out in Annex IV. The testers shall use the scope specification document and the targeted threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; report as a basis for producing the attack scenarios.

The testers shall consult the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test;, the threat intelligence provider means the experts, contracted by the financial entity for each TLPT, and external to the financial entity and to ICT intra-group service providers if any, who collect and analyse targeted threat intelligence relevant for the financial entities in scope of a specific TLPT exercise and develop matching relevant and realistic threat scenarios;, and the test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation; on the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan, including the communication, procedural and project management arrangement, the preparation and use-cases for leg-up means the assistance or information provided by the control team to the testers to enable the testers to continue the execution of an attack path where they are not able to advance on their own, and where no other reasonable alternative exists, including for insufficient time or resources in a given TLPT; activation, and the reporting agreements to the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; and test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation;.

Where the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan is complete and ensures the performance of an effective TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems, the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; and the TLPT authority means any of the following: the single public authority in the financial sector designated in accordance with Article 26(9) of Regulation (EU) 2022/2554; the authority in the financial sector to which the exercise of some or all of the tasks in relation to TLPT is delegated in accordance with Article 26(10) of Regulation (EU) 2022/2554; any of the competent authorities referred to in Article 46 of Regulation (EU) 2022/2554; shall approve the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan and the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems shall inform the control team lead means the staff member of the financial entity responsible for the conduct of all TLPT-related activities for the financial entity in the context of a given test; thereof.

Upon approval of the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan in accordance with paragraph 3, the testers shall carry out the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems during the active red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing phase.

The duration of the active red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing phase shall be proportionate to the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems scope, to the scale, activity, complexity and number of the financial entitiesas defined in Article 2, points (a) to (t) and ICT third-party or ICT intragroup service providers involved in the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems, and in any case shall last for at least 12 weeks. Attack scenarios may be executed in sequence or at the same time. The control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test;, the threat intelligence provider means the experts, contracted by the financial entity for each TLPT, and external to the financial entity and to ICT intra-group service providers if any, who collect and analyse targeted threat intelligence relevant for the financial entities in scope of a specific TLPT exercise and develop matching relevant and realistic threat scenarios;, the testers and the test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation; shall agree on the end of the active red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing phase.

Subject to ensuring that the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan remains complete and allows for the performance of an effective TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems, the control team lead means the staff member of the financial entity responsible for the conduct of all TLPT-related activities for the financial entity in the context of a given test; and the test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation; shall approve any changes to the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan subsequent to its approval, including to the timeline, scope, target systems or flags are key objectives in the ICT systems supporting critical or important functions of a financial entity that the testers try to achieve through the test;.

During the entire active red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing phase, testers shall report at least weekly to the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; and test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation; on the progress made in the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems, and the threat intelligence provider means the experts, contracted by the financial entity for each TLPT, and external to the financial entity and to ICT intra-group service providers if any, who collect and analyse targeted threat intelligence relevant for the financial entities in scope of a specific TLPT exercise and develop matching relevant and realistic threat scenarios; shall remain available for consultation and additional threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; when requested by the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test;.

The control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; shall timely provide leg-ups means the assistance or information provided by the control team to the testers to enable the testers to continue the execution of an attack path where they are not able to advance on their own, and where no other reasonable alternative exists, including for insufficient time or resources in a given TLPT; designed on the basis of the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; test plan. Leg-ups means the assistance or information provided by the control team to the testers to enable the testers to continue the execution of an attack path where they are not able to advance on their own, and where no other reasonable alternative exists, including for insufficient time or resources in a given TLPT; may be added or adapted upon approval by the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; and the test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation;.

In the case of detection of the testing activities by any staff member of the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; or of its ICT third-party service providers means an undertaking providing ICT services; or ICT intragroup service provider, where relevant, the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test;, in consultation with the testers and without prejudice to paragraph 10, shall propose and submit measures allowing to continue the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems while ensuring its secrecy to the test managers means staff designated to lead the activities of the TLPT authority for a specific TLPT to monitor compliance with this Regulation; for validation.

Under exceptional circumstances triggering risks means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident; of impact on data, damage to assets, and disruption to critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law;, services or operations of the financial entity means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations; itself, of its ICT third-party service providers means an undertaking providing ICT services; or ICT intragroup services providers, or disruptions to its counterparts or to the financial sector, the control team lead means the staff member of the financial entity responsible for the conduct of all TLPT-related activities for the financial entity in the context of a given test; may suspend the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems, or, as a last resort, where the continuation of the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems is not otherwise possible and subject to prior validation by the TLPT authority means any of the following: the single public authority in the financial sector designated in accordance with Article 26(9) of Regulation (EU) 2022/2554; the authority in the financial sector to which the exercise of some or all of the tasks in relation to TLPT is delegated in accordance with Article 26(10) of Regulation (EU) 2022/2554; any of the competent authorities referred to in Article 46 of Regulation (EU) 2022/2554;, continue the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems using a limited purple teaming means a collaborative testing activity that involves both the testers and the blue team; exercise. The duration of the limited purple teaming means a collaborative testing activity that involves both the testers and the blue team; exercise shall be counted for the purpose of the 12-week minimum duration of the active red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing phase referred to in paragraph 5.