TLP WHITE - FINAL On conclusion of the test, the Red Team should produce a Penetration Test Report. This report should include details of the approach taken for testing as well as the findings and observations from the test. It should evaluate the risks and existing controls and, where necessary, provide advice regarding areas for improvement. Element 5: Closure and Remediation Following completion of the Penetration Testing phase, the TLPT moves into the Closure phase, which aims to allow all relevant stakeholders to analyze and respond to the outcome of the test and make improvements to further enhance the cyber resilience of the tested entity. The penetration testing provider is typically responsible for supporting any post-test workshops including the presentation of findings to the entity. The entity is responsible for: (i) distributing the findings to the appropriate stakeholders using agreed upon secure delivery means; (ii) arranging post-test workshops with the relevant stakeholders to discuss the findings and identify potential mitigation solutions; and (iii) producing and executing upon a full remediation plan. The relevant authority is responsible for engaging with the entity and agreeing on the remediation plan; and following up on the execution of the remediation plan as part of its normal engagement with the entity. Element 6: Thematic data One of the core objectives of the G7FE-TLPT is to contribute to the improvement of the cyber resilience of entities and the financial sector more generally. An important means of achieving this is the production and sharing of thematic data amongst authorities and entities. Thematic data should identify common sector findings and vulnerabilities. All thematic results must prevent identification of individual entities. Jurisdictions have the discretion of using their own recognized frameworks as the base for creating post-TLPT thematics and the production of thematic data relating to TLPT engagements is the responsibility of the relevant authorities. Authorities may consider a number of approaches to information sharing, where appropriate and consistent with data protection and cross-jurisdictional information sharing norms. TLP WHITE: Subject to standard copyright rules, this document may be distributed freely, without restriction. 7