All courses / AI Purple / Module 5 / Chapter 21
Learning objectives
After the lesson the participant can:
- Explain which regime applies to Nordvik Region and to Hansa Mutual and why the difference matters.
- Compare a threat-led penetration test under DORA with continuous emulation and explain how the two are kept apart.
- Classify obligations from the instruments by the stage of the loop they constrain.
- Draft obligation register entries that map an article to a control, an evidence artefact with an age, an owner and a review date.
Key concepts
- Threat-led penetration testing
- Under DORA Article 26, entities the competent authorities identify carry out TLPT at least every three years on live production systems, by testers who meet Article 27, under Delegated Regulation (EU) 2025/1190, with a mandatory replay and purple teaming exercise at closure.
- Hold list
- The list (HLD-HM-TLPT-01 at Hansa Mutual) that keeps the continuous pipeline from masking or revealing a covert threat-led test. Continuous emulation is not a TLPT, and its manifest, authority and evidence are kept apart.
- Management body duties
- NIS 2 Article 20(1) has the management body approve the cybersecurity risk-management measures, oversee their implementation and be capable of being held liable for infringements of Article 21; Article 21(2)(f) asks for policies and procedures to assess the effectiveness of the measures.
- Authorisation as the dividing line
- The Directive on attacks against information systems has Member States criminalise access without right. The owner's written authorisation for each asset is what separates an exercise from an offence, so the manifest carries a consent field per boundary.
- Obligation register
- The OBL record that maps each instrument and article to a restated obligation, the stage it constrains, the control, the evidence artefact with an age limit, an owner and a review date. An open entry with a question and a person is a legitimate state.
Interactive exercises
Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.
Interactive exercise 1 · Match
Instruments and what they ask of the loop
Match each provision with what the chapter reports it requires. These are design implications, not legal advice.
Interactive exercise 2 · Sort
Threat-led test or continuous emulation
Sort each property by whether the chapter attributes it to a threat-led penetration test or to a rolling pipeline of catalogued S1 scenarios.
Teaching plan
| 15 min | The teacher explains which regime applies to whom: Nordvik Region under NIS 2 as transposed, national law and the GDPR; Hansa Mutual's German entity under DORA. |
| 20 min | Teacher-led walk through the instruments on the figure, attaching each to the stages it governs, with the five consequences of DORA for the loop. |
| 35 min | Exercise: write obligation register entries for the instruments that apply to the participant's organisation or to one of the two fictional organisations. |
| 10 min | Pairs discuss staff and their representatives: agreements govern classes of exercise and not single dates, and a covert test is notified as a class. |
| 10 min | Plenary on the labels: what is observable in the texts, what is expected of supervisors, and what is speculation, such as harmonised treatment of AI-assisted emulation. |
Discussion
- The Delegated Regulation on TLPT contains no provision on AI. What should an organisation do before planning an agent in a supervised test, and why ask first?
- Agreements with staff govern classes of exercise so that a covert test can be notified as a class and not as a date. What trust does that arrangement require on both sides?
- Nordvik Region keeps an open entry on the disclosure of synthetic content in a deepfake scenario under AI Act Article 50(4). When is holding a scenario the right design decision?
Written exercise
Exercise · 35 minutes
An obligation register for the loop
Write six entries of an obligation register for your own organisation, or extend OBL-NR-2028-01 or OBL-HM-2028-01. For each entry follow the practical guide: name the instrument, article, paragraph and point as the chapter gives them and the date on which you read the text; restate the obligation in one sentence in architectural terms, naming the addressee; name the stage of the loop it constrains and the control that meets it, a manifest field, a policy-point rule, a contract clause, a runbook step or a record; name the evidence artefact, its holder and its age limit; and name the owner, a deputy and the review date. Mark at least one entry open, with the question and the person who will answer it. Treat the entries as design implications, not legal advice.
Deliverable: Six register entries, each with instrument and article, restated obligation, stage, control, evidence with age, owner and review date, one of them open.
Self-test
Choose an answer to see whether it is right, or open the answer below each question.
How does the chapter relate continuous emulation to a threat-led penetration test under DORA?
Show the answer
C. Continuous emulation is not a TLPT; the two are kept apart, and a hold list protects the test's secrecy.
A TLPT is a regulated project the loop receives: covert, threat-led, run by testers who meet Article 27. Continuous emulation is kept apart from it, and a hold list keeps the pipeline from masking or revealing the test.Which provision does the chapter cite for policies and procedures to assess the effectiveness of cybersecurity risk-management measures?
Show the answer
B. NIS 2 Article 21(2)(f).
NIS 2 Article 21(2)(f) lists policies and procedures to assess the effectiveness of cybersecurity risk-management measures. In Nordvik Region's register it is met by coverage records and evidence manifests with an age.What, according to the chapter, separates an authorised emulation from a criminal offence?
Show the answer
D. The authorisation of the owner or right holder of each asset, recorded in the manifest.
The offences concern conduct without right. Authorisation comes from the owner or right holder of each asset, which is why the manifest carries a consent field per boundary and a default-deny policy point.