The control team must ensure that at the end of testing the testers and threat intelligence provider securely delete compromised passwords, credentials and keys, securely tell the entity which accounts were compromised and securely collect, store and dispose of test data; that testers also deactivate command and control, use scope and date kill switches, remove backdoors and malware, handle potential breach notification, provide for future backup restoration where tools or malware were installed, and monitor and report possible blue team detections; and that neither destroys equipment without authorisation, modifies information or assets in an uncontrolled way, deliberately compromises the continuity of critical or important functions, includes out-of-scope systems or discloses results without authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.