TLPT evidence for supervisors

Evidence for supervisors is the record that allows an independent reader to judge whether TLPT was properly scoped, realistically executed, honestly reported and followed up. It includes the service maps and scope decisions, the threat intelligence picture, the test plan and timelines, the findings with their supporting logs, the remediation plan, and the record of progress against that plan. Without that chain of evidence, a TLPT report is an assertion. With it, supervisors can verify the exercise, challenge its conclusions, and track whether resilience is actually improving.

Credible evidence is specific, dated and linked. A claim that detection improved should be supported by timelines from successive cycles. A claim that a finding is closed should be supported by verification that the fix works. A claim that a system was out of scope should be supported by a reasoned exclusion. Supervisors are not looking for perfect results. They are looking for a record that shows the firm understands its critical functions, has tested them honestly, and is acting on what it learned.

The package begins before testing, with the scope, the service maps, the intelligence picture and the tester arrangements. It continues through testing, with the test plan, safety arrangements, control logs and timelines. It ends after testing, with the findings report, the remediation plan and progress updates. Each part should be dated and owned, so that a supervisor can follow the exercise from planning to follow up without having to reconstruct it from scattered documents.

Organisation by critical function is usually clearest. A supervisor can then examine one function at a time, seeing its map, its scope, its scenarios, its findings and its remediation together. Organisation by system alone fragments that picture, because a single attack path may cross several systems. Organisation by date alone buries the function view under chronology. A function based structure, with cross references to shared systems and suppliers, gives the clearest account.

Evidence should also be stored securely and retained for the period the framework expects. TLPT material is sensitive: it describes weaknesses, attack paths and response gaps. Access should be limited to those who need it, and sharing beyond the agreed audience should follow the framework arrangements. At the same time, evidence must remain retrievable. A finding that cannot be located when a supervisor asks about it, because it sits in a personal mailbox or an unlabelled folder, is effectively no evidence at all.

Credibility comes from corroboration. A finding supported by log extracts, alert records and a timeline is more credible than a finding supported only by a tester's assertion. A remediation claim supported by retest evidence or monitoring data is more credible than a claim supported only by a statement that work was completed. A scope decision supported by a service map and a recorded reason is more credible than a scope decision stated without explanation. Supervisors look for that corroboration, particularly for findings that are disputed or for remediation that is claimed to be complete.

Gaps should be presented openly, not hidden. If a target system was excluded, the evidence should say why and what alternative assurance was obtained. If a scenario could not be completed for safety reasons, the evidence should say where it stopped and what that implies. If a finding could not be fully verified, the evidence should say so. Open presentation of limitations allows supervisors to judge the exercise fairly, and it protects the firm from a later accusation that it overstated its assurance.

A firm that presents a partial exercise as comprehensive will lose credibility when the gap is discovered, as it usually is. A firm that presents a partial exercise honestly, with a plan to close the gap, retains credibility and gains a clear agenda for the next cycle. Supervisors understand that live production testing involves constraints. What they expect is that constraints are visible, reasoned and managed, not that they are absent.

The same evidence that serves supervisors can serve the firm. Boards can use function based reporting to judge where investment is needed. System owners can use attack path timelines to understand why a control failed. Detection teams can use alert records to improve monitoring. Supplier managers can use findings about supplier access to renegotiate arrangements. Evidence that is produced only for supervisors, and never used internally, is a wasted opportunity.