ANNEX VIII
Details of the attestation of the TLPT referred to in Article 26(7) of Regulation (EU) 2022/2554
The attestation shall contain at least all of the following information:
(a) | on the performed TLPT: the starting and end dates of the TLPT; the critical or important functions in scope of the test; where relevant, information on critical or important functions in scope of the test in relation to which the TLPT was not performed; where relevant, other financial entities that were involved in the TLPT; where relevant, the ICT third-party services providers that participated in the TLPT; in respect of testers: whether internal testers were used; whether Article 5(3), second subparagraph, was used by the financial entity; the duration, in calendar days, of the active red team testing phase; |
(b) | where several TLPT authorities have been involved in the TLPT, the other TLPT authorities, and in which capacity; |
(c) | list of the documents examined by the TLPT authority for the purposes of the attestation. |