Red Team
What is Red Team?
A group of security professionals authorised to simulate real-world attacks against an organisation to test its defences. Red team exercises are more comprehensive than penetration tests and evaluate people, processes, and technology holistically.
Terms that appear alongside red team
Each of these is named in at least one of the same controls as red team. The number is how many controls name both.
- nist 16 shared controls
- cybersecurity 13 shared controls
- penetration testing 12 shared controls
- resilience 11 shared controls
- governance 9 shared controls
- compliance 9 shared controls
- audit 9 shared controls
- vulnerability 9 shared controls
Frameworks that govern red team
What the standards actually require on red team
Requirements naming red team across 6 standards, quoted from the control text.
The red-team provider drafts a Red Team Test Report detailing the scenarios executed, the attack paths, findings and observations.
TIBER-3.1 · Red Team Test Report →After the threat intelligence report is approved the testers prepare a red team test plan with the Annex IV content from the scope document and threat intelligence, consulting the control team, threat intelligence provider and test managers on communication, p...
dora-rts-on-threat-led-penetration-testing-commission-delegated-regulation-eu-2025-1190::11.1 · Article 11(1) to (6): Red team test plan and active testing period →Employ technical specialists to attempt to break into the organisation's networks (red teaming) to test defences.
ASIC-CR-DE-3 · Red teaming →Conduct red team operations and penetration testing on a regular basis to simulate real-world attacks and reveal risks that vulnerability scanning does not surface.
ASBv3-PV-7 · Conduct regular red team operations →Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CA-8(2) · Penetration Testing | Red Team Exercises (CA-8(2)) →Penetration Testing | Red Team Exercises. Employ the following red-team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement: [Assignment: organization-defined red team exercises]
CA-8(2) · Penetration Testing | Red Team Exercises (CA-8(2)) →Questions people ask about red team
What is Red Team?
Why is Red Team important for compliance?
Which compliance frameworks address Red Team?
Where can I learn more about Red Team?
See how Red Team applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.