TIBER-EU Service Provider Procurement Guidance

Abstract

Guidance issued under the TIBER-EU framework describing requirements, selection criteria, and governance considerations for procuring Threat Intelligence Providers (TIPs) and Red Team Testers (RTTs) when conducting intelligence-led red-team tests on live production systems in the financial sector.

Key Takeaways

• ✓
  Defines mandatory and recommended requirements for selecting Threat Intelligence Providers (TIPs) and Red Team Testers (RTTs) in TIBER-EU tests.
• ✓
  Emphasizes governance, risk management, confidentiality, and ethical standards when procuring testing providers.
• ✓
  Specifies competence, experience, staffing, and certification expectations for threat intelligence and red team personnel.
• ✓
  Provides detailed procurement considerations, due-diligence questions, and example contractual clauses to support safe and controlled testing.
• ✓
  Highlights the importance of realistic threat scenarios, collaboration between TIP and RTT, and strict handling of sensitive information.

Keywords