DORA RTS on Threat-Led Penetration Testing

The red team test report shall contain information on at least all of the following:

1. (a)
   information on the performed attack, including:

   1. (i)
      the targeted critical or important functions and identified ICT systems, processes and technologies supporting the critical or important function, as identified in the red team test plan;
   2. (ii)
      summary of each scenario;
   3. (iii)
      flags reached and not reached;
   4. (iv)
      attack paths followed successfully and unsuccessfully;
   5. (v)
      tactics, techniques and procedures used successfully and unsuccessfully;
   6. (vi)
      deviations from the red team test plan, if any;
   7. (vii)
      leg-ups granted, if any;

2. (b)
   all actions that the testers are aware of that were performed by the blue team to reconstruct the attack and to mitigate its effects;
3. (c)
   discovered vulnerabilities and other findings, including:

   1. (i)
      vulnerability and other finding description including their criticality;
   2. (ii)
      root cause analysis of successful attacks;
   3. (iii)
      recommendations for remediation including indication of the remediation priority.