After the scope is approved the threat intelligence provider analyses generic and sector threat intelligence (optionally using the authority's national threat landscape as a baseline), identifies threats and vulnerabilities and gathers targeted, actionable intelligence on the entity, consulting the control team and test managers. It presents threats and proposes scenarios that differ by threat actor and tactics, techniques and procedures and target each critical or important function in scope. The control team lead selects at least three scenarios based on the provider's recommendation, test manager input, tester feasibility judgement and the entity's size and risk profile; at most one may be a forward-looking scenario that is not threat-led, and pooled or joint tests must include a scenario covering the shared provider's underlying systems. The provider delivers a targeted threat intelligence report with the Annex III content, which the control team submits for authority approval.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.