(i)

the targeted critical or important functions and identified ICT systems, processes and technologies supporting the critical or important function, as identified in the red team test plan;

(ii)

summary of each scenario;

(iii)

flags reached and not reached;

(iv)

attack paths followed successfully and unsuccessfully;

(v)

tactics, techniques and procedures used successfully and unsuccessfully;

(vi)

deviations from the red team test plan, if any;

(vii)

leg-ups granted, if any;

(i)

vulnerability and other finding description including their criticality;

(ii)

root cause analysis of successful attacks;

(iii)

recommendations for remediation including indication of the remediation priority.