TLP WHITE - FINAL Prior to inclusion within the Penetration Test Plan, a coordinated approach should be developed that allows the stakeholders to challenge the threat intelligence deliverables, and to map the agreed-upon cyber threat scenarios to in-scope systems. This coordination, generally facilitated by the entity, allows the Red Team to develop a more focused Penetration Test Plan in line with the primary objectives of the test. Throughout this process, and during the Penetration Testing phase, the threat intelligence provider should continue to offer their expertise, as and when required. In cases of entities offering services in various jurisdictions, the different stakeholders should take due consideration of sharing the deliverables across jurisdictions, given the sensitivity and confidentiality of the information. Element 4: Penetration Testing Following completion of the Threat Intelligence phase, the Red Team should plan and execute a test of the target systems and services, as defined in the scope. It is recommended that based on the scope, sufficient time be allocated to the Penetration Testing phase to allow the Red Team to conduct a realistic test in which the cyber threat scenarios are executed. Roles and Responsibilities The Red Team is typically responsible for the following: (i) producing a Penetration Test Plan, aligned to the scope and risk management processes, which clearly sets out the scenarios to be followed during the test; (ii) conducting the test in accordance with the cyber threat scenarios generated from the output of the threat intelligence provider; and (iii) drafting and issuing the final Penetration Test Report to the entity. The White Team is responsible for: (i) coordinating and facilitating test activities; (ii) maintaining continuous dialogue with the Red Team and providing additional support where necessary; (iii) overseeing and monitoring the Blue Team; and (iv) applying effective risk management controls (including halting the test at any point, if deemed necessary). The relevant authorities may observe the test alongside the White Team. Test Methodology, Approach and Deliverables The entity should conduct a TLPT assessment in accordance with the requirements of the relevant authorities from whom they wish to seek acceptance of the test. The Red Team should utilize the threat intelligence deliverables to develop a targeted Penetration Test Plan. The entity should ensure that the Red Team is afforded sufficient time to appropriately conduct the test. In accordance with the risk management controls, the White Team should monitor the execution of the test throughout, to ensure risks to target system(s) are minimized. The entity should have an understanding of testing requirements for production and nonproduction environments, as these may be subject to mandatory requirements in some jurisdictions. TLP WHITE: Subject to standard copyright rules, this document may be distributed freely, without restriction. 6