BELOW THE WATERLINE STAGE 2 - REGULATING RED TEAMS

Summary from the TLDR InfoSec newsletter

Regulated red team engagements have to be defensible when reconstructed later, so every action needs a named approver, an understood risk, and evidence tying it to the threat scenario. The six frameworks compared (CBEST, TIBER-EU, DORA TLPT, I-CRT, iCAST, and DESC ISR) differ in authority, testing basis, and provider requirements, with DORA Article 26 mandating TLPT at least every three years for designated financial entities. Red team leads should record timestamps, approvals, and any supplied access during delivery, because a detection that fires in purple-team replay does not prove it worked during the covert phase.