Documentation

The TIBER-EU Framework is the basis document that explains how the TIBER framework can be implemented in a jurisdiction. 

Download the TIBER-EU Framework

The Control Team are the only people, from the organisation that is being tested, that know the test is ongoing. This document gives guidance what skills and knowledge the different people in the Control Team should have. 

Download the TIBER-EU Control Team Guidance

This guidance describes the requirements for the TIBER-EU initiation documents. These documents, that have to be created by the Control Team, describe amongst other things the project planning of the TIBER test, the desired codename and communication channels to be used.

Download the TIBER-EU Initiation Documents Guidance

The Guidance for Service Provider Procurement shows the requirements the providers need to full fill in order for the TIBER test to be recognised as such. 

Download the TIBER-EU Guidance for Service Provider Procurement

Based on the Scope Specification Document Guidance the Control Team can outline their critical functions, the underlying systems and the flags that should be achieved by the Red Team Testers.

Download the Scope Specification Document Guidance

This document gives guidance to the Threat Intelligence provider on what elements the Targeted Threat Intelligence Report should contain. In their research the Threat Intelligence provider should get information on the  business of the entity, what can be found about the entity online and what its threat landscape looks like. These three elements are then combined in the Targeted Threat Intelligence Report with the most relevant threat actor scenarios. 

Download the TIBER-EU Targeted Threat intelligence Report Guidance

The Red Team Test Plan contains the plan the Red Team Testers follow to simulate the attack of the threat actor on the tested entity. This guidance document shows which elements the Test Plan should contain.

Download the TIBER-EU Red Team Test Plan Guidance

After the Red Team test has been executed the findings are presented by the Red Team Testers in the Red Team Test Report. This guidance document gives the elements that should be present in the Red Team Test Report.

Download the TIBER-EU Red Team Test Report Guidance

For an optimal Purple Teaming session it is critical that the Blue Team knows what they saw of the Red Team test and how they reacted. This guidance shows how the Blue Team can document their actions.

Download the TIBER-EU Blue Team Report Guidance

After the Red Team test in the closure phase purple teaming can be executed where the Red and Blue Teams work together to increase the learnings of the test. Also when the Red Team test has to be stopped prematurely the Purple Teaming Best Practices gives guidance on how purple teaming can be used.

Download the TIBER-EU Purple Teaming Best Practices

Since the Red Team Test Report is a sensitive document it should not be shared too widely. Therefore a test summary report is created that contains the high level findings of the test. This can be shared wider within the entity when needed, with other supervisors or peers in the sector. This document gives guidance on what elements this report should contain. 

Download the TIBER-EU Test Summary Report Guidance

As a result of the test the entity gets a Red Team Report that shows the findings of the test. In the Remediation Report the entity shows how these findings will be addressed. This guidance supports the entity in this process. 

Download the TIBER-EU Remediation Plan Guidance

This attestation template can be used by TIBER authorities to issue an attestation to the entity that the test has been performed according to the TIBER-EU framework. This is signed by the responsible TIBER authority. 

Download the TIBER-EU Attestation Template