Article 7 Selection of TLPT providers


    1. The control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; shall take measures to manage the risks relating to the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems and shall in particular ensure that, for each TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems:

      1. the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider and external testers provide the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; with a detailed curriculum vitae and copies of certifications that, according to recognised market standards, are appropriate for the performance of their activities;

      2. the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider and external tester are duly and fully covered by proper professional indemnity insurances including against risks of misconduct and negligence;

      3. the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider provides at least three references from previous assignments in the context of penetration testing and red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

      4. the external testers provide at least five references from previous assignments related to penetration testing and red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

      5. the staff of the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider assigned to the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems:

        1. is composed of at least a manager with at least 5 years’ experience in threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; and at least one additional member with at least 2 years’ experience in threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations;;

        2. display a broad range and appropriate level of professional knowledge and skills, including:

          1. intelligence gathering tactics, techniques and procedures;

          2. geopolitical, technical and sectorial knowledge;

          3. adequate communication skills to clearly present and report on the result of the engagement;

        3. has a combined participation in at least three previous assignments in threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; in the context of penetration testing and red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

        4. does not simultaneously perform any blue team tasks means tasks that are typically carried out by the blue team such as security operation centre (SOC), ICT infrastructure services, helpdesk services, incident management services at operational level; or other services that may present a conflict of interest with respect to the financial entity, ICT third-party service provider means an undertaking providing ICT services; or an ICT intra-group service provider means an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control; involved in TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems to which they are assigned;

        5. is separated from and not reporting to staff of the same TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems provider providing external testers for the same TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems;

      6. for external testers, the red team means the testers, internal or external, contracted for, or assigned to, a TLPT; assigned to the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems:

        1. is composed of at least a manager, with at least 5 years of experience in penetration testing and red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing as well as at least two additional testers, each with penetration testing and red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing of at least 2 years;

        2. displays a broad range and appropriate level of professional knowledge and skills, including knowledge about the business of the financial entity, reconnaissance, risk management, exploit development, physical penetration, social engineering, vulnerability means a weakness, susceptibility or flaw of an asset, system, process or control that can be exploited; analysis, as well as adequate communication skills to clearly present and report on the result of the engagement;

        3. has a combined participation in at least five previous assignments related to penetration testing and red team means the testers, internal or external, contracted for, or assigned to, a TLPT; testing;

        4. is not employed by, nor provides services to, a threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider that simultaneously performs blue team tasks means tasks that are typically carried out by the blue team such as security operation centre (SOC), ICT infrastructure services, helpdesk services, incident management services at operational level; for either a financial entity, an ICT third-party service provider means an undertaking providing ICT services;, or an ICT intra-group service provider means an undertaking that is part of a financial group and that provides predominantly ICT services to financial entities within the same group or to financial entities belonging to the same institutional protection scheme, including to their parent undertakings, subsidiaries, branches or other entities that are under common ownership or control; that is involved in the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems;

        5. is separated from any staff of the same TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems provider that simultaneously provides threat-intelligence services for the same TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems;

      7. the testers and the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider carry out restoration procedures at the end of testing, including secure deletion of information related to passwords, credentials, and other secret keys compromised during the TLPT(threat-led penetration testing) a framework that mimics the tactics, techniques and procedures of real-life threat actors perceived as posing a genuine cyber threat, that delivers a controlled, bespoke, intelligence-led (red team) test of the financial entity’s critical live production systems, secure communication to the financial entitiesas defined in Article 2, points (a) to (t) of the accounts compromised, secure collection, storage, management, and disposal of other data collected during testing;

      8. testers, in addition to the restoration procedures at the end of testing as referred to in point (g), carry out the following restoration procedures:

        1. command and control deactivation;

        2. scope and date kill switches;

        3. removal of backdoors and other malware;

        4. potential breach notification;

        5. procedures for future back-up restoration which may concern malware or tools installed during the test;

        6. monitoring of the blue team means the staff of the financial entity and, where relevant, staff of the financial entity’s third-party service providers and any other party deemed relevant in consideration of the scope of the TLPT, of the financial entity’s third-party service providers, that are defending a financial entity's use of network and information systems by maintaining its security posture against simulated or real attacks and that is not aware of the TLPT; activities and informing the control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; of any possible detections;

      9. testers and the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; provider do not perform, or participate in, any of the following activities:

        1. unauthorised destruction of equipment of the financial entity and of its ICT third-party service providers means an undertaking providing ICT services;, if any;

        2. uncontrolled modification of information and ICT assets means a software or hardware asset in the network and information systems used by the financial entity; of the financial entity and of its ICT third-party service providers means an undertaking providing ICT services;, if any;

        3. intentionally compromising the continuity of critical or important functions means a function, the disruption of which would materially impair the financial performance of a financial entity, or the soundness or continuity of its services and activities, or the discontinued, defective or failed performance of that function would materially impair the continuing compliance of a financial entity with the conditions and obligations of its authorisation, or with its other obligations under applicable financial services law; of the financial entity;

        4. unauthorised inclusion of out-of-scope systems;

        5. unauthorised disclosure of test results.

    1. The control team means the team composed of staff of the tested financial entity and, where relevant in consideration of the scope of the TLPT, staff of its third-party service providers and any other party, who manages the test; shall keep record of the documentation provided by the testers and the threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; providers to evidence compliance with paragraph 1, points (a) to (f).

    2. In exceptional circumstances, financial entitiesas defined in Article 2, points (a) to (t) may contract external testers and threat intelligence means information that has been aggregated, transformed, analysed, interpreted or enriched to provide the necessary context for decision-making and to enable relevant and sufficient understanding in order to mitigate the impact of an ICT-related incident or of a cyber threat, including the technical details of a cyber-attack, those responsible for the attack and their modus operandi and motivations; providers that do not meet one or more of the requirements set out in paragraph 1, points (a) to (f), provided that those financial entitiesas defined in Article 2, points (a) to (t) adopt measures that are appropriate to mitigate the risks relating to the lack of compliance with such points and record those measures.

We're continuously improving our platform to serve you better.

Your feedback matters! Let us know how we can improve.

Found a bug?

Springflod is a Swedish boutique consultancy firm specialising in cyber security within the financial services sector.

We offer professional services concerning information security governance, risk and compliance.

Crafted with ❤️ by Springflod