Annex VII Details of the report summarizing the relevant findings of the TLPT referred to in Article 26(6) of Regulation (EU) 2022/2554

the parties involved;

the project plan;

the validated scope, including the rationale behind the inclusion or exclusion of critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; and identified ICT systems, processes, and technologies supporting the critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; covered by the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems;

selected scenarios and any significant deviation from the targeted threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; report;

executed attack paths, and used tactics, techniques and procedures;

captured and non-captured flags;

deviations from the red team test plan, if any;

blue team detections, if any;

purple teaming in testing phase, where conducted and the related conditions;

leg-ups used, if any;

risk management measures taken;

identified vulnerabilities means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; and other findings, including their criticality;

root cause analysis of successful attacks;

high level plan for remediation, linking the vulnerabilities means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; and other findings, their root causes and remediation priority;

lessons derived from feedback received.