DORA RTS on Threat-Led Penetration Testing

The blue team test report shall contain information on at least all of the following:

1. 1.
   for each attack step described by the testers in the red team test report:

   1. (a)
      list of detected attack actions;
   2. (b)
      log entries corresponding to these detections;

2. 2.
   assessment of the findings and recommendations of the testers;
3. 3.
   evidence of the attack by the testers collected by the blue team;
4. 4.
   blue team root cause analysis of successful attacks by the testers;
5. 5.
   list of lessons learned and identified potential for improvement;
6. 6.
   list of topics to be addressed in purple teaming.