ANNEX V
Content of the red team test report (Article 12(2))
The red team test report shall contain information on at least all of the following:
(a) | information on the performed attack, including: the targeted critical or important functions and identified ICT systems, processes and technologies supporting the critical or important function, as identified in the red team test plan; summary of each scenario; flags reached and not reached; attack paths followed successfully and unsuccessfully; tactics, techniques and procedures used successfully and unsuccessfully; deviations from the red team test plan, if any; leg-ups granted, if any; |
(b) | all actions that the testers are aware of that were performed by the blue team to reconstruct the attack and to mitigate its effects; |
(c) | discovered vulnerabilities and other findings, including: vulnerability and other finding description including their criticality; root cause analysis of successful attacks; recommendations for remediation including indication of the remediation priority. |