Learn with CREST : CCRTM-SC training material for 100% pass

Background: You are the Control Team Lead's primary point of contact at the Red Team provider for a TIBER-EU engagement against Larchmont Insurance SE. In week 9 of the required 12-week active Red Team testing phase, your team achieves the agreed primary objective (demonstrating a realistic path to manipulating claims-payment data) far earlier than the original plan anticipated, and does so without being detected by the Blue Team at any point. Your lead tester messages you, enthusiastic, suggesting that since the objective is already achieved with three weeks of the mandated minimum window still remaining, the team should simply
"wrap up early, write the report now, and free up the team for other engagements," since "we've proven the point already and nothing important is likely to change in the remaining weeks." Separately, the Threat Intelligence Report identified a secondary, lower-probability but still plausible threat actor and attack path (targeting the SE entity's cross-border reinsurance data-sharing arrangements) that the original test plan had allocated the remaining weeks to explore, time permitting.
Question: Assess the lead tester's suggestion to conclude testing early, and explain what should actually happen with the remaining three weeks of the mandated testing window.

See The answer in Explanation part below.
Explanation:
Step 1 - Recognise why the suggestion, though understandable, is methodologically incorrect. The lead tester's enthusiasm is understandable - achieving the primary objective undetected is a genuinely strong result - but the suggestion to end active testing three weeks early conflicts directly with TIBER-EU's minimum 12-week active testing guidance, which exists, as covered in the syllabus, for substantive methodological reasons (allowing realistic, patient adversary emulation and providing a genuine, sustained test of detection capability over a realistic timeframe), not merely as an arbitrary box to tick once any single objective is achieved.
Step 2 - Reject the "we've proven the point already" framing. Early achievement of the primary objective does not mean "nothing important is likely to change" - this framing significantly understates the value of the remaining time. As established elsewhere in this syllabus, a well-planned TIBER-EU engagement should have identified secondary, still-plausible attack paths (exactly as this scenario describes, with the cross-border reinsurance data-sharing scenario) precisely so that remaining time can be used productively rather than the exercise simply stopping once one objective is reached.
Step 3 - Do not unilaterally decide to end testing early. As Red Team provider lead contact, you should not agree to end active testing early based on your lead tester's operational preference (however reasonably intentioned, including the genuine desire to free up the team for other work) without this being a decision made transparently with the Control Team and, given TIBER-EU's minimum-duration guidance, very likely requiring at least awareness of the national TIBER Cyber Team, consistent with the syllabus principle that material deviations from framework timing guidance should not be decided informally by the delivery team alone.
Step 4 - Recommend pivoting to the secondary threat actor/attack path for the remaining weeks. The professionally sound recommendation is to use the remaining three mandated weeks productively by pivoting to explore the secondary, still-plausible threat actor and attack path (the cross-border reinsurance data-sharing scenario) that the original plan had specifically reserved time for - this makes full, valuable use of the mandated window, provides Larchmont with meaningfully broader insight beyond the single already-proven objective, and respects the framework's minimum-duration guidance in substance, not just in form.
Step 5 - Address the resourcing tension honestly rather than ignoring it. The lead tester's underlying point about wanting to free up the team for other engagements reflects a genuine resourcing/capacity consideration (echoing the concurrent-engagement management principle discussed elsewhere in this practice set), and this should not simply be dismissed - but the correct response is to raise this transparently with your own firm's resourcing/practice management function as a separate capacity planning conversation, rather than allowing it to unilaterally drive premature conclusion of a live, regulator-relevant engagement that has mandated timing requirements.
Step 6 - Communicate transparently with the Control Team about the strong early result and the plan for the remaining time. You should proactively inform the Control Team of the strong, undetected achievement of the primary objective (itself a significant, positive finding worth flagging promptly, consistent with the reporting domain's guidance on timely communication of significant developments) and explain the plan to use the remaining mandated weeks to explore the secondary, still-plausible scenario - giving the Control Team full visibility and the opportunity to input on or endorse this plan, rather than either silently continuing without explanation or silently stopping early without their knowledge.
Step 7 - Consider whether the strong result also has an earlier learning opportunity, without ending testing.
While full closure/purple-teaming should still occur only at the properly planned end of the Testing phase, you might also confirm with the Control Team whether they wish to be given a preliminary, high-level heads- up about the strength of the primary result now (while continuing testing on the secondary path) - a judgement call to be made collaboratively with the Control Team, balancing their interest in early insight against maintaining full engagement momentum and Blue Team blindness through to the properly planned closure point.
Conclusion: The lead tester's suggestion to end active testing three weeks early should not be accepted; the mandated minimum testing window should be used productively by pivoting to the secondary, still-plausible threat actor and attack path the original plan reserved time for, with this plan communicated transparently to the Control Team; and any genuine resourcing/capacity tension underlying the tester's suggestion should be addressed separately through the provider's own internal capacity management, not by cutting short a live, framework-governed engagement.
---

Background: You are the Red Team Manager responsible for delivering a CBEST engagement for Solenne Retail Bank plc, a UK bank designated by the Bank of England as core to financial stability. Your firm has been engaged as the accredited penetration testing provider; a separate accredited firm is delivering the threat intelligence workstream. Six weeks into the Threat Intelligence phase, the CTI provider's draft Targeting Intelligence Report identifies a financially motivated, moderately sophisticated organised crime group as the most plausible threat actor, based on strong evidence of similar groups actively targeting three comparable UK retail banks in the preceding twelve months using business email compromise, credential phishing, and abuse of a common payment-processing middleware product that Solenne also uses.
Two days before the Targeting Intelligence Report is due to be finalised, Solenne's Group CISO - who chairs the Control Group - contacts you directly (bypassing the CTI provider) and states that the board would "much prefer" the scenario to focus on a sophisticated nation-state actor, because the board considers this "more prestigious" and because a recent internal strategy paper positioned Solenne as being concerned primarily with nation-state risk. The CISO asks you, as the penetration testing provider, to simply proceed with planning a nation-state-style scenario regardless of what the CTI provider's report concludes, to save time given the tight testing window ahead of a fixed year-end reporting deadline.
Separately, your own delivery team flags that the payment-processing middleware identified by the CTI provider as a plausible attack path is also used by a separate, unrelated business unit of Solenne's parent group that was explicitly excluded from the agreed CBEST scope.
Question: As Red Team Manager, how should you respond to (a) the Group CISO's request to disregard the CTI provider's evidence-based conclusion in favour of a nation-state scenario, and (b) the discovery that the identified plausible attack path touches an excluded business unit? Explain the governance principles underpinning your response and the specific steps you would take.

See The answer in Explanation part below.
Explanation:
Step 1 - Recognise what is actually being asked and why it matters. The scenario tests whether the candidate understands that CBEST's entire value proposition rests on being genuinely intelligence-led: scenarios must be built from real, evidence-based analysis of plausible threat actors, not from what is organisationally convenient, prestigious, or aligned with a pre-existing internal narrative. Overriding the CTI provider's evidence-based conclusion with an unevidenced "preference" for a nation-state actor would directly undermine the exercise's validity and its value to the regulator and the firm itself.
Step 2 - Do not simply comply. As Red Team Manager, you should not proceed with planning a nation-state scenario on the strength of an informal, evidence-free instruction from the Group CISO alone, however senior. Doing so would (i) breach the intelligence-led methodology the CBEST Implementation Guide requires, (ii) risk producing a Red Team Test Report that tests an implausible threat and therefore fails to surface Solenne's genuine, evidenced exposure to the organised crime group actively targeting comparable banks, and (iii) potentially undermine the credibility of the whole engagement if reviewed by the Bank of England.
Step 3 - Escalate transparently and constructively through the correct governance channel. The appropriate response is to raise the concern directly and professionally with the Group CISO (and, if necessary, the full Control Group), explaining the methodological and regulatory reasons why scenario selection must follow the evidence, not organisational preference. You should involve the CTI provider in this conversation, since they authored the underlying analysis and the decision materially affects their deliverable - sidelining them because the CISO approached you directly would itself be a governance failure. Where the Control Group wishes to explore a nation-state dimension as a genuinely additional consideration (for example, if there is separate, real evidence supporting some nation-state relevance), this should be assessed on its own evidential merits, not substituted for the evidenced organised-crime scenario.
Step 4 - Document the discussion and outcome. Whatever is ultimately decided, the rationale should be documented in the Control Group's records and reflected consistently in the Scope Specification/Threat Intelligence documentation, preserving a clear audit trail - this protects the integrity of any eventual attestation or supervisory review and protects you and your firm professionally.
Step 5 - Address the excluded business unit finding. The discovery that the plausible attack path traverses a system also used by an explicitly excluded business unit is a scope boundary issue and must be handled through the change control process discussed throughout the syllabus, not resolved informally. You should pause and flag this to the Control Group before any scenario design assumes exploitation of that shared middleware in a way that would require touching the excluded unit's environment. The Control Group needs to decide, with appropriate input from the excluded unit's own stakeholders if their systems could genuinely be affected, whether to (a) formally and narrowly extend scope with proper authorisation to cover the shared component only insofar as it affects the in-scope business, (b) design the scenario so it demonstrates the risk path up to the shared component without actually exploiting into the excluded unit's environment, or (c) exclude that specific attack path and document the residual risk for separate follow-up. Proceeding to exploit into the excluded unit's systems without this authorisation would risk exceeding the CBEST authorisation given, with the legal exposure (e.g., under the Computer Misuse Act 1990) discussed elsewhere in the syllabus, since the excluded unit's own stakeholders have not consented.
Step 6 - Balance timeline pressure against integrity. The year-end deadline pressure does not justify compromising either the intelligence-led premise or scope integrity. If timeline pressure genuinely cannot accommodate a proper resolution of both issues, this should be raised transparently with the Control Group as a resourcing/timeline risk, with options presented (e.g., a short, agreed extension, or a narrowed but still evidence-based scenario), rather than silently cutting corners on governance to hit an arbitrary date.
Conclusion: The correct response combines professional pushback grounded in the intelligence-led methodology (not blind compliance with an unevidenced senior request), transparent escalation through the Control Group with the CTI provider properly involved, and disciplined change-control handling of the scope boundary issue - all documented - rather than either silently complying or unilaterally deciding either matter without the Control Group.
---