Risk Dialogue Protocol
A structured, asynchronous, bidirectional exchange protocol enabling clients to submit concrete threat scenarios and suppliers to respond with step-by-step defensive posture assessments aligned to EBIOS RM, MITRE ATT&CK, and TIBER-EU.
Overview
TPSA-02 addresses a fundamental gap that TPSA-01 cannot cover alone: no standardized channel exists for clients to communicate their threat landscape to suppliers, or for suppliers to respond with structured defensive posture assessments.
TPSA-02 is mandatory for ENHANCED and FULL suppliers. BASIC suppliers may adopt it voluntarily.
Not Another Questionnaire
An RSC presents a concrete attack scenario relevant to the client's threat landscape and asks the supplier to map its defences against each step forcing specificity and honesty. This transforms TPSA from information-sharing into accountability.
The protocol defines three primary exchange types:
- Risk Scenario Cards (RSC) client → supplier: concrete threat scenarios using EBIOS RM + MITRE ATT&CK
- Supplier Risk Assessments (SRA) supplier → client: step-by-step control coverage assessment
- TIBER-EU Coordination Messages (TEC) for DORA Art. 26 TLPT exercises (TPSA Full)
- Classification Uplift Requests (CUR) client → supplier (defined in TPSA-01)
- Key Risk Indicator (KRI) exchanges quantitative continuous monitoring signals
Protocol Architecture
Channel Requirements
- Authentication: ED25519 certificate pairs (consistent with TPSA-01 H-13). Every message is signed and verified.
- Confidentiality: TLS 1.3 + end-to-end payload encryption (NaCl/libsodium crypto_box using recipient's public key)
- Transport agnostic: TPSA Reference Platform API, supplier portal, encrypted email (PGP/S-MIME with JSON), or offline (signed JSON on encrypted media)
Message Lifecycle
| State | Transition | Description |
|---|---|---|
| DRAFT | Author creates | Being composed. Not yet transmitted. |
| SUBMITTED | Author sends | Transmitted. Acknowledgement timer begins. |
| ACKNOWLEDGED | Receiver confirms | Accepted for processing. Response timer begins. |
| RESPONDED | Responder sends SRA | Formal response sent. Initiator reviews. |
| CLOSED | Initiator accepts/escalates | Exchange complete. Full record retained for audit. |
Risk Scenario Card (RSC)
The RSC maps directly to the EBIOS Risk Manager workshop structure:
| EBIOS Workshop | TPSA Mapping | Author |
|---|---|---|
| WS1 Scope | Pre-populated from Disclosure Card (TPSA-01 D1-01) | Supplier |
| WS2 Risk Sources | RSC Section A: Risk Source Identification | Client |
| WS3 Strategic Scenarios | RSC Section B: Strategic Scenario | Client |
| WS4 Operational Scenarios | RSC Section C: MITRE ATT&CK Mapping | Client |
| WS5 Risk Treatment | SRA response + Joint treatment plan | Supplier + Joint |
RSC Section A Risk Source Identification
- RSC-A01 Risk Sources: SR type (State-sponsored / Organised Crime / Hacktivist / Insider / Competitor / Opportunistic), known TTPs
- RSC-A02 Target Objectives: data exfiltration, service disruption, espionage, ransomware, supply chain compromise
- RSC-A03 Sector context (Mandatory)
- RSC-A04 Threat Intel references CERT advisories, STIX 2.1 bundles (Optional)
RSC Section B Strategic Scenario
- RSC-B01 Scenario title
- RSC-B02 Entry point referencing TPSA-01 D1-01 asset IDs
- RSC-B03 Attack path narrative
- RSC-B04 Target assets
- RSC-B05 Feared event
- RSC-B07 Impact estimate
RSC Section C Operational Scenario (MITRE ATT&CK)
The core of the RSC: an ordered list of attack steps, each with:
- ATT&CK Technique ID, name, and tactic
- Target asset ID (from D1-01)
- Description of the technique as applied to this scenario
- Expected detection status: DETECT / PARTIAL / BLIND / UNKNOWN (Optional)
- Specific questions to the supplier about this step (Optional)
Supplier Risk Assessment (SRA)
The SRA is the supplier's point-by-point response to each step of the client's operational scenario. Each step receives:
| Field | Content | Required |
|---|---|---|
| SRA-S03 | Control Status | M |
| COVERED effective control demonstrated | PARTIAL control exists but incomplete | GAP no effective control | NOT_APPLICABLE | ||
| SRA-S04 | Controls Description specific technology, configuration, monitoring rules, detection logic | M |
| SRA-S05 | Detection Capability: DETECT / PARTIAL / BLIND | M |
| SRA-S06 | Evidence Reference (mandatory when COVERED) | C |
| SRA-S07 | Gap Analysis (mandatory when not COVERED) | C |
| SRA-S08 | Remediation Plan: responsible party, target date, interim controls | C |
The SRA summary provides an overall assessment (ADEQUATE / PARTIALLY_ADEQUATE / INADEQUATE), coverage statistics, residual risk statement, and remediation roadmap.
TIBER-EU / TLPT Integration
DORA Art. 26(4) requires critical ICT third-party providers to participate in TLPT exercises. TPSA provides the operational infrastructure:
Scoping (TEC-SCOPE)
Leverages the Disclosure Card's D1-01 asset register. Because assets are already structured and current, scoping is dramatically accelerated no additional reconnaissance needed.
Execution (TEC-EXEC)
Incident coordination, scope adjustments, and safety signals during the exercise. Pre-existing RSCs can serve as input for test scenario design, targeting already-identified gaps.
Results (TEC-RESULTS)
Findings mapped to ATT&CK techniques, detection performance, remediation plan using SRA-S08 format. Disclosure Card update triggered. Pen testing feeds continuously back into the accountability cycle.
Key Risk Indicators (KRI)
KRIs add a quantitative, continuous monitoring layer. RSCs are episodic; KRIs provide ongoing, measurable signals of operational security health.
| KRI ID | Category | Metric | Acceptable Threshold |
|---|---|---|---|
| KRI-VULN-001 | Vulnerability | Critical vulns remediated within SLA (24h) | ≥ 95% |
| KRI-VULN-002 | Vulnerability | High vulns remediated within SLA (72h) | ≥ 90% |
| KRI-VULN-003 | Vulnerability | Unpatched critical/high vulns older than SLA | 0 |
| KRI-BACKUP-001 | Backup | Last successful restore test (days ago) | ≤ 90 days |
| KRI-BACKUP-002 | Backup | Backup success rate (last 30 days) | ≥ 99.5% |
| KRI-ACCESS-001 | Access Control | Privileged accounts with MFA | 100% |
| KRI-ACCESS-002 | Access Control | Days since last access rights review | ≤ 90 days |
| KRI-INCIDENT-001 | Incident | MTTD for critical/high alerts (hours) | ≤ 1 hour |
KRI breach thresholds trigger mandatory notifications. Persistent degradation (3+ consecutive periods) is reportable at TPSA surveillance audit.
Response Timelines
| Action | BASIC | ENHANCED | FULL |
|---|---|---|---|
| RSC Acknowledgement | N/A (voluntary) | 10 business days | 5 business days |
| SRA Response | N/A | 30 business days | 15 business days |
| Classification Uplift Response | N/A | 30 business days | 15 business days |
| TIBER-EU Scoping Response | N/A | 20 business days | 10 business days |
Conformance Requirements
TPSA Enhanced suppliers must: accept RSCs from clients with active Client-Specific Annexes; acknowledge within 10 business days; respond via SRA within 30 business days; maintain an exchange log; designate a named Risk Dialogue contact.
TPSA Full suppliers additionally must: support TIBER-EU Coordination Messages; implement the TPSA Reference Platform API or a conformant equivalent; trigger Disclosure Card updates within 15 days when SRA findings reveal material posture changes.