TLPT planning and preparation

Planning and preparation for TLPT cover everything that must be agreed before testers attempt an attack path in live production. That includes governance and ownership, the scope and scenarios, the threat intelligence picture, tester selection, safety arrangements, supplier engagement, communications with staff, and the handling of findings. Preparation is not administrative overhead. It is what makes a live production test safe enough to run, realistic enough to be useful, and credible enough to be relied on by supervisors.

Good preparation also sets expectations. Everyone involved should know what will be tested, what will not be tested, how safety will be protected, who can halt the test, and how findings will be handled. Without that shared understanding, a test can cause unnecessary disruption, damage trust between teams, or produce findings that are disputed because the rules were unclear. Preparation time is therefore an investment in the quality of the exercise that follows.

Governance starts with a named owner at a senior level, responsible for the exercise, for its safety, and for its follow up. That owner should be supported by a small planning group that includes resilience, security, technology, operations and risk representatives, together with the testers and the intelligence provider. The group should meet regularly during preparation, keep a record of decisions, and escalate issues that affect scope, safety or timing before they become problems during testing.

Board or committee oversight should be established early, not sought retrospectively. The overseeing committee should approve the scope in broad terms, understand the production risks, and expect to receive the findings and remediation plan. That oversight gives the exercise authority inside the firm, particularly when it needs cooperation from business lines or suppliers that might otherwise resist. It also ensures that findings will be acted on, because the committee that approved the test will also track the remediation.

Safety arrangements are the most important part of preparation. They include a risk assessment for each scenario, safeguards for each target system, agreed stop conditions, and a control team that can halt the test at any point. Scenarios that could corrupt data, halt a critical service or affect customers should be designed with particular care, using techniques that demonstrate access without causing harm, or using agreed safe actions that prove a point without proceeding to a destructive step.

Safety also covers communications during the test. Detection teams need to know, in general terms, that a test is under way, so that they do not treat it as a real incident and trigger an unnecessary customer communication or market disclosure. At the same time, they should not know the precise scenarios, or their response will not be realistic. That balance is agreed in advance, documented, and briefed to the teams concerned. A test that surprises its own response teams into a real incident response has failed in its preparation, however good its scenarios may be.

Suppliers whose systems are in scope should be engaged early, with a clear explanation of what is proposed, what safeguards apply, and how findings will be shared. Early engagement allows suppliers to raise legitimate concerns, to suggest safer techniques, and to prepare their own teams. Late engagement, by contrast, often produces refusal or a rushed arrangement that satisfies no one. Supplier agreements for TLPT should be recorded, including notice periods, contact points and handling of supplier findings.

A test plan contains the scope, the service maps, the intelligence picture, the scenarios with their stages and safeguards, the tester arrangements, the safety and stop conditions, the communications plan, and the reporting and remediation arrangements. Each scenario should state its objective, its intelligence source, its target systems, its expected detection points, and its safe stopping point. That detail allows the firm, the testers and the authority to review the plan before testing, and allows the control team to manage it during testing.

The plan should also contain a timetable that is realistic. Preparation, testing, reporting and remediation each take time, and compressing any stage usually reduces quality. A timetable that allows for review, for supplier engagement and for safety checks is more likely to produce a credible exercise than a timetable driven by a desire to finish quickly. The plan should state dependencies, such as change freezes or supplier availability, so that delays can be managed rather than discovered mid test.

Readiness can be judged by a checklist completed shortly before testing starts. Is the scope agreed and recorded? Is the intelligence picture current? Are testers selected and independent? Are safety arrangements and stop conditions agreed? Are suppliers engaged? Are communications briefed? Is the reporting and remediation process agreed? If any answer is no, testing should be delayed until it can be answered yes, unless the gap is minor and explicitly accepted with a mitigation.