Article 7 Selection of TLPT providers

1. the threat intelligence provider and external testers provide the control team with a detailed curriculum vitae and copies of certifications that, according to recognised market standards, are appropriate for the performance of their activities;

2. the threat intelligence provider and external tester are duly and fully covered by proper professional indemnity insurances including against risks of misconduct and negligence;

3. the threat intelligence provider provides at least three references from previous assignments in the context of penetration testing and red team testing;

4. the external testers provide at least five references from previous assignments related to penetration testing and red team testing;

5. the staff of the threat intelligence provider assigned to the TLPT:

   1. is composed of at least a manager with at least 5 years’ experience in threat intelligence and at least one additional member with at least 2 years’ experience in threat intelligence;

   2. display a broad range and appropriate level of professional knowledge and skills, including:

      1. intelligence gathering tactics, techniques and procedures;

      2. geopolitical, technical and sectorial knowledge;

      3. adequate communication skills to clearly present and report on the result of the engagement;

   3. has a combined participation in at least three previous assignments in threat intelligence in the context of penetration testing and red team testing;

   4. does not simultaneously perform any blue team tasks or other services that may present a conflict of interest with respect to the financial entity, ICT third-party service provider or an ICT intra-group service provider involved in TLPT to which they are assigned;

   5. is separated from and not reporting to staff of the same TLPT provider providing external testers for the same TLPT;

6. for external testers, the red team assigned to the TLPT:

   1. is composed of at least a manager, with at least 5 years of experience in penetration testing and red team testing as well as at least two additional testers, each with penetration testing and red team testing of at least 2 years;

   2. displays a broad range and appropriate level of professional knowledge and skills, including knowledge about the business of the financial entity, reconnaissance, risk management, exploit development, physical penetration, social engineering, vulnerability analysis, as well as adequate communication skills to clearly present and report on the result of the engagement;

   3. has a combined participation in at least five previous assignments related to penetration testing and red team testing;

   4. is not employed by, nor provides services to, a threat intelligence provider that simultaneously performs blue team tasks for either a financial entity, an ICT third-party service provider, or an ICT intra-group service provider that is involved in the TLPT;

   5. is separated from any staff of the same TLPT provider that simultaneously provides threat-intelligence services for the same TLPT;

7. the testers and the threat intelligence provider carry out restoration procedures at the end of testing, including secure deletion of information related to passwords, credentials, and other secret keys compromised during the TLPT, secure communication to the financial entities of the accounts compromised, secure collection, storage, management, and disposal of other data collected during testing;

8. testers, in addition to the restoration procedures at the end of testing as referred to in point (g), carry out the following restoration procedures:

   1. command and control deactivation;

   2. scope and date kill switches;

   3. removal of backdoors and other malware;

   4. potential breach notification;

   5. procedures for future back-up restoration which may concern malware or tools installed during the test;

   6. monitoring of the blue team activities and informing the control team of any possible detections;

9. testers and the threat intelligence provider do not perform, or participate in, any of the following activities:

   1. unauthorised destruction of equipment of the financial entity and of its ICT third-party service providers, if any;

   2. uncontrolled modification of information and ICT assets of the financial entity and of its ICT third-party service providers, if any;

   3. intentionally compromising the continuity of critical or important functions of the financial entity;

   4. unauthorised inclusion of out-of-scope systems;

   5. unauthorised disclosure of test results.

The control team shall keep record of the documentation provided by the testers and the threat intelligence providers to evidence compliance with paragraph 1, points (a) to (f).

In exceptional circumstances, financial entities may contract external testers and threat intelligence providers that do not meet one or more of the requirements set out in paragraph 1, points (a) to (f), provided that those financial entities adopt measures that are appropriate to mitigate the risks relating to the lack of compliance with such points and record those measures.