DORA RTS on Threat-Led Penetration Testing (Commission Delegated Regulation (EU) 2025/1190) 11.1: Article 11(1) to (6): Red team test plan and active testing period

After the threat intelligence report is approved the testers prepare a red team test plan with the Annex IV content from the scope document and threat intelligence, consulting the control team, threat intelligence provider and test managers on communication, project management, leg-up use cases and reporting. The control team and authority approve the plan before testing starts. The active red team testing phase must be proportionate to scope and complexity and last at least 12 weeks; scenarios may run in sequence or in parallel, its end is agreed by the parties, and any later change to timeline, scope, targets or flags needs approval of the control team lead and test managers.