# ANNEX V — Content of the red team test report (Article 12(2)) **Commission Delegated Regulation (EU) 2025/1190 · binding · OJ L, 2025/1190, 18.6.2025 · dated 13 Feb 2025 [in force]** *In force · Commission Delegated Regulation (EU) 2025/1190, OJ L, 2025/1190, 18.6.2025 · Checked against EUR-Lex on 26 Oct 2026 · [Official source](https://eur-lex.europa.eu/eli/reg_del/2025/1190/oj/eng)* The red team test report shall contain information on at least all of the following: **(a)** information on the performed attack, including:\ i) the targeted critical or important functions and identified ICT systems, processes and technologies supporting the critical or important function, as identified in the red team test plan;\ ii) summary of each scenario;\ iii) flags reached and not reached;\ iv) attack paths followed successfully and unsuccessfully;\ v) tactics, techniques and procedures used successfully and unsuccessfully;\ vi) deviations from the red team test plan, if any;\ vii) leg-ups granted, if any;\ **(b)** all actions that the testers are aware of that were performed by the blue team to reconstruct the attack and to mitigate its effects;\ **(c)** discovered vulnerabilities and other findings, including:\ i) vulnerability and other finding description including their criticality;\ ii) root cause analysis of successful attacks;\ iii) recommendations for remediation including indication of the remediation priority.\