What is the primary reason TIBER-EU emphasises cross-border consistency across EU member states?

• A. To allow financial groups operating across multiple EU jurisdictions to conduct testing in a way that is mutually recognised and reduces duplicative, inconsistent national requirements
• B. To centralise all testing exclusively at the ECB with no national involvement
• C. To standardise currency exchange rates
• D. Cross-border consistency is not actually a design goal of TIBER-EU

Which of the following best describes the relationship between the scope document and the Rules of Engagement?

• A. They are the same document under two different names, with no meaningful distinction
• B. Scope is only relevant to CBEST engagements, while RoE is only relevant to TIBER-EU engagements
• C. Scope defines what is included/excluded at a strategic level (systems, objectives, boundaries), while the RoE translates that into detailed, operational rules for how testing will actually be conducted day to day
• D. The RoE is produced long before scope is even discussed

Which of the following is the most appropriate way to handle a request to include operational technology (OT) or industrial control systems (ICS) with potential life-safety implications within the scope of a red team engagement?

• A. Automatically exclude all OT/ICS systems from every engagement with no further discussion
• B. Allow testing to proceed without informing engineering or safety teams, to preserve realism
• C. Include them in the same manner and with the same techniques as standard IT systems, with no special consideration
• D. Apply significantly enhanced caution - carefully assess whether live testing is appropriate at all, consider safer alternative approaches (e.g., testing in a representative non-production environment, or a more limited, closely supervised assessment), and involve relevant engineering/safety stakeholders in the scoping decision

For a Red Team Manager overseeing multiple intelligence-led engagements across jurisdictions, what is the most important practical implication of frameworks like iCAST, CBEST, and TIBER-EU having similar but not identical requirements?

• A. Each engagement must be planned against the specific scheme's actual governance, documentation, timing, and accreditation requirements, rather than assuming interchangeability across frameworks
• B. It is safe to apply exactly the same generic process and documentation across every jurisdiction without adaptation
• C. Only the Red Team's technical toolset needs to change between jurisdictions; governance can remain identical
• D. Jurisdictional differences are purely cosmetic and can be ignored by an experienced manager