After active testing the control team lead informs the blue team that a test took place. Within four weeks the testers deliver a red team test report (Annex V) that the control team passes to the blue team and test managers; within ten weeks of the end of active testing the blue team delivers a blue team test report (Annex VI) shared with testers and test managers, both without sensitive information where the test managers ask. Within ten weeks the blue team and testers replay offensive and defensive actions and the control team runs a purple teaming exercise on jointly identified topics; all parties then exchange feedback. Once the authority confirms the two reports are complete, the entity submits within eight weeks a test summary report (Annex VII) for approval under DORA Article 26(6).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.