Guía de implementación TIBER-ES: Threat Intelligence Based Ethical Red-Teaming-Spain

Sep 4, 2026

The guide defines and explains the TIBER-ES threat intelligence based ethical red-teaming framework for advanced cyber security testing in Spain. It outlines the background and relationship with TIBER-EU, introduces the overall testing process from preparation to closure, and describes stakeholder roles including authorities, participants and providers. It also addresses risk management and explains how test results are used for financial supervision and oversight. The annex provides a responsibility matrix to support governance and execution.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages26

Reading Time1 h 6 min

AccessFree to download

Contents

Abbreviations

1 Introduction

1.1 Background

1.2 What is TIBER-EU?

1.3 What is TIBER-ES?

1.4 Purpose of this guide

1.5 Introduction to the TIBER-ES process

1.6 Who is eligible for this type of testing?

2 Stakeholders and their roles

2.1 The role of participant authorities

2.2 Participants

2.2.1 TIBER Cyber Team

2.2.2 Entity being tested

2.2.3 Providers

3 The TIBER-ES test process

3.1 Preparation

3.2 Testing

3.3 Closure

4 Risk management

5 Test results and their use in financial supervision and oversight

Annex Responsibility matrix

TIBER-ES IMPLEMENTATION GUIDE Threat Intelligence Based Ethical Red-Teaming-Spain TIBER-ES IMPLEMENTATION GUIDE Threat Intelligence Based Ethical Red-Teaming-Spain TIBER-ES IMPLEMENTATION GUIDE Threat Intelligence Based Ethical Red-Teaming-Spain Contents Abbreviations 5 1 Introduction 5 1.1 Background 5 1.2 What is TIBER-EU? 6 1.3 What is TIBER-ES? 7 1.4 Purpose of this guide 7 1.5 Introduction to the TIBER-ES process 8 1.6 Who is eligible for this type of testing? 8 2 Stakeholders and their roles 10 2.1 The role of participant authorities 10 2.2 Participants 10 2.2.1 TIBER Cyber Team 10 2.2.2 Entity being tested 11 2.2.3 Providers 11 3 The TIBER-ES test process 13 3.1 Preparation 13 3.2 Testing 16 3.3 Closure 19 4 Risk management 22 5 Test results and their use in financial supervision and oversight 23 Annex Responsibility matrix 24 5 TIBER-ES IMPLEMENTATION GUIDE Threat Intelligence Based Ethical Red-Teaming-Spain Abbreviations BT BTTR GTL RT RTTR TCT TI TKC TLPT TTI TTM TTP WT WTL Blue Team Blue Team Test Report Generic Threat Landscape Red Team Red Team Test Report TIBER Cyber Team Threat Intelligence TIBER-EU Knowledge Centre Threat Led Penetration Testing Targeted Threat Intelligence Team Test Manager Tactics, Techniques and Procedures White Team White Team Lead 1 Introduction Technology is a key element in allowing financial institutions1 to offer their services in a reliable and safe way that is consistent with their strategy and business model. Factors such as the high level of interconnectedness within the financial sector and with third parties, the continuous and rapid development of technology, the growing number and sophistication of cyber threats, the digitalisation of financial transactions and remote working have made entities’ cyber resilience and cyber security a priority both from prudential and financial stability angles. In this setting, entities’ most vulnerable points may be subject to attacks that can sometimes be highly complex. Therefore, it is paramount that entities reduce their vulnerabilities and have in place an effective and mature cyber security control environment. However, this approach will only be successful if it allows them to effectively confront a real cyber attack. In that sense, Threat Led Penetration Testing (TLPT) or intelligence-led red teaming tests aim to anticipate, insofar as possible, the impact that a real cyber attack could have on an entity. In order to do so, in this type of advanced cyber security testing, cyber attacks are simulated using the Tactics, Techniques and Procedures (TTP) that a sophisticated attacker would use. Accordingly, these tests constitute a very powerful tool to improve entities’ cyber resilience. 1.1 Background In 2016 the Bank of England published the first red teaming framework for the financial sector, CBEST.2 In the same vein, in 2017 the Netherlands published the TIBER-NL3 (Threat Intelligence 1 For the purposes of this guide, the term “entity” will be used for simplicity, referring not only to any entity, institution or organisation that provides financial services to clients or members but also to the financial market infrastructures needed to provide those services. 2 [https://www.bankofengland.co.uk/-/media/boe/files/financial-stability/financial-sector-continuity/cbest-implementation-guide](https://www.bankofengland.co.uk/-/media/boe/files/financial-stability/financial-sector-continuity/cbest-implementation-guide). 3 [https://www.dnb.nl/media/1mdf3lmq/tiber-nl-guide.pdf](https://www.dnb.nl/media/1mdf3lmq/tiber-nl-guide.pdf). Based Ethical Red-teaming) framework, drawing on CBEST but with its own characteristics. Different jurisdictions around the world have also expressed their intention to develop local red teaming testing frameworks. In this setting, in May 2018 the European Central Bank (ECB) published TIBER-EU, its ow

FAQs

What is TIBER-ES and what is it intended to achieve?

TIBER-ES is an intelligence-led ethical red-teaming testing framework. It aims to help entities identify weaknesses and strengths in cyber resilience and define measures to enhance resilience when facing a realistic cyber attack.

Who are the main stakeholders in a TIBER-ES test?

Stakeholders include participant authorities, the TIBER Cyber Team, the entity being tested, and external providers. Their roles support planning, execution, and alignment with the framework requirements.

How does the TIBER-ES test process work from start to finish?

The process follows preparation, testing, and closure stages. This structure supports effective execution of simulated attacks and subsequent use of outcomes.

Sep 4, 2026

Upload by Ethan Miller