{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2026-10-26","gaps":[],"covered":["2025/1190 — RTS — TLPT [in force] L2"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"EUR-Lex"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iv","url":"https://www.headlesslaw.com/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iv","title":"ANNEX IV — Content of the red team test plan (Article 11(1))","family":"l2_unit_view","work_id":"spaces/dora/level-2/rts/2025-1190-tlpt","view_of":"/dora/level-2/rts/2025-1190-tlpt","status":"in_force","force_status":"in_force","date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"Commission Delegated Regulation (EU) 2025/1190, OJ L, 2025/1190, 18.6.2025","check":{"against":"EUR-Lex","on":"2026-10-26"},"check_result":"matched","official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng","valid_from":"2025-07-08","valid_until":null,"content_id":"8d93da27f69abc3e","versions":["2025-07-08"],"version_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iv/versions/2026-10-26","revision_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iv/versions/2026-10-26/rev/8d93da27f69abc3e","versions_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iv/versions","relations_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iv/relations","act_url":"https://www.headlesslaw.com/dora/level-2/rts/2025-1190-tlpt#annex-iv","source_line":"Commission Delegated Regulation (EU) 2025/1190 · binding · OJ L, 2025/1190, 18.6.2025 · dated 13 Feb 2025 [in force]","attribution":{"prepared_by":"European Commission","published_by":"Publications Office of the EU","published_in":"Official Journal of the European Union","document_type":"delegated_regulation","legal_nature":"binding_adopted","addressees":"not stated in the document","dates":{"document_date":"2025-02-13","published_on":"2025-06-18","entry_into_force":"2025-07-08","locators":{"document_date":"CELLAR 32025R1190 work_date_document","published_on":"CELLAR 32025R1190 official-journal-act_date_publication","entry_into_force":"CELLAR 32025R1190 resource_legal_date_entry-into-force (earliest)"}},"adoption":null},"context":{"act":{"work_id":"spaces/dora/level-2/rts/2025-1190-tlpt","path":"/dora/level-2/rts/2025-1190-tlpt","name":"Commission Delegated Regulation (EU) 2025/1190","number":"2025/1190","celex":"32025R1190","title_official":"COMMISSION DELEGATED REGULATION (EU) 2025/1190 of 13 February 2025 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria used for identifying financial entities required to perform threat-led penetration testing, the requirements and standards governing the use of internal testers, the requirements in relation to the scope, testing methodology and approach for each phase of the testing, results, closure and remediation stages and the type of supervisory and other relevant cooperation needed for the implementation of TLPT and for the facilitation of mutual recognition (Text with EEA relevance)","document_date":"2025-02-13"},"position":{"kind":"annex","key":"annex-iv","index":4,"articles":17,"annexes":8},"prev":{"path":"/dora/level-2/rts/2025-1190-tlpt/annexes/annex-iii","key":"annex-iii","title":"ANNEX III — Content of the targeted threat intelligence report (Article 10(5))"},"next":{"path":"/dora/level-2/rts/2025-1190-tlpt/annexes/annex-v","key":"annex-v","title":"ANNEX V — Content of the red team test report (Article 12(2))"},"act_anchor":"#annex-iv"}},"provenance":{"official_url":"https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng","check":{"result":"matched","checked_at":"2026-10-26","against":"EUR-Lex"},"repo_path":"spaces/dora/level-2/rts/2025-1190-tlpt.md","unit_text_sha256":"d8923a6b700b8077c8c3f01d5793f34858ed153255de14859da2704aeee83f75","note":"the unit is a byte-exact part of the act page, whose check record covers it"},"unit":{"locator":"spaces/dora/level-2/rts/2025-1190-tlpt/annex-iv","kind":"annex","key":"annex-iv","heading":"ANNEX IV — Content of the red team test plan (Article 11(1))","text":"## ANNEX IV — Content of the red team test plan (Article 11(1))\n\n<a id=\"annex-iv\"></a>The red team test plan shall contain information on all of the following:\n\n**(a)** communication channels and procedures;\\\n**(b)** the tactics, techniques and procedures allowed and not-allowed for use in the attack, including ethical boundaries for social engineering;\\\n**(c)** the risk management measures to be followed by the testers;\\\n**(d)** a description for each scenario, including:\\\n   i) the simulated threat actor;\\\n   ii) their intent, motivation and goals;\\\n   iii) the target function(s) and the supporting ICT system or systems;\\\n   iv) the targeted confidentiality, integrity, availability and authenticity aspects;\\\n   v) flags;\\\n**(e)** a detailed description of each expected attack path, including pre-requisites and possible leg-ups to be provided by the control team, including deadlines for their provision and potential usage;\\\n**(f)** the scheduling of red teaming activities, including time planning for the execution of each scenario, at a minimum split according to the three phases a tester takes throughout the testing phase, respectively entering financial entities’ ICT systems, moving through the ICT systems and ultimately executing actions on objectives and eventually extracting itself from the ICT systems (in, through, and out phases);\\\n**(g)** particularities of the financial entities’ infrastructure to be considered during testing;\\\n**(h)** if any, additional information or other resources necessary to the testers for executing the scenarios.\\\n\n","marks":[],"text_hash":"d8923a6b700b8077c8c3f01d5793f34858ed153255de14859da2704aeee83f75","revision":1}}