ECB published guidance on the roles and responsibilities of the White Team in a Threat Intelligence-Based Ethical Red Teaming (TIBER-EU) test. The guidance covers the roles and responsibilities of the White Team during the preparation, testing, and closure phases of a TIBER-EU test; the composition of the White Team; the requisite skills and experience of the White Team; and the organizational aspects of the White Team.
The TIBER-EU White Team Guidance is an integral part of the TIBER-EU Framework. The TIBER-EU framework enables European and national authorities to work with financial infrastructures and institutions to put in place a program to test and improve their resilience against sophisticated cyber attacks. TIBER-EU is an instrument for red team testing, designed for use by core financial infrastructures, whether at national or at European level, which can also be used by any type or size of entity across the financial and other sectors. TIBER-EU is designed to be adopted by the relevant authorities in any jurisdiction, on a voluntary basis and from a variety of perspectives, as a supervisory or oversight tool, for financial stability purposes, or as a catalyst. So far, ECB has published guidance on implementing the TIBER-EU Framework and Guidelines for the TIBER-EU Services Procurement Guidelines.
The White Team is the team—within the entity being tested—that is responsible for the overall planning and management of the test, in accordance with the TIBER-EU Framework. The members of the White Team are the only people within the entity being tested that know that a TIBER-EU test is taking place. The White Team must ensure that the TIBER-EU test is conducted in a controlled manner, with appropriate risk management controls in place, while maximizing the learning experience for the entity. For this, the White Team must closely cooperate with the TIBER Cyber Team (TCT) from the respective authority.
Related Link: TIBER-EU White Team Guidance (PDF)
Keywords: Europe, EU, Banking, Securities, PMI, Cyber Risk, Cyber Resilience, TIBER-EU, White Team, ECB
Previous ArticleESRB Dashboard Examines Systemic Risks in EU
In a letter addressed to the industry, the Australian Prudential Regulation Authority (APRA) set out an updated schedule of policy priorities for the banking, insurance, and superannuation industries.
The European Commission (EC) adopted a comprehensive review package of Solvency II rules in the European Union.
The Office of the Comptroller of the Currency (OCC) issued Versions 1.0 of the "Earnings" and "Regulatory Reporting" booklets of the Comptroller's Handbook.
The European Central Bank (ECB) published results of its economy-wide climate stress test, which aimed to assess the resilience of non-financial corporates and euro area banks to climate risks.
The European Banking Authority (EBA) published a report on the use of digital platforms in the banking and payments sector in European Union.
The Hong Kong Monetary Authority (HKMA) published updates on the policy measures that were announced in context of the ongoing pandemic.
The International Swaps and Derivatives Association (ISDA), along with several other associations, submitted a joint response to the Basel Committee on Banking Supervision (BCBS) consultation on preliminary proposals for the prudential treatment of cryptoasset exposures.
BIS published the September issue of the Quarterly Review, which contains special features that analyze the rapid rise in equity funding for financial technology firms, the effectiveness of policy measures in response to pandemic, and the evolution of international banking.
The Basel Committee for Banking Supervision (BCBS) met in September 2021 and reviewed climate-related financial risks, discussed impact of digitalization, and welcomed efforts by the International Financial Reporting Standards (IFRS) Foundation to develop a common set of sustainability reporting standards
The Office of the Comptroller of the Currency (OCC) issued a Cease and Desist Order against MUFG Union Bank for deficiencies in technology and operational risk governance.