list_phases
Retrieve the three TIBER-EU TLPT phases and their deliverables to plan your compliance process.
Instructions
List the 3 TIBER-EU TLPT phases with deliverables.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Implementation Reference
- meok_dora_tlpt_planner/server.py:358-361 (handler)The tool handler function decorated with @mcp.tool() that returns the TIBER_PHASES constant dictionary containing the 3 TIBER-EU TLPT phases (preparation, testing, closure) with their durations, descriptions, deliverables, and stakeholders.
@mcp.tool() def list_phases() -> dict[str, Any]: """List the 3 TIBER-EU TLPT phases with deliverables.""" return TIBER_PHASES - The TIBER_PHASES constant dictionary that serves as the data/return schema for the list_phases tool. Contains the three phases: preparation (4-8 weeks), testing (12-16 weeks), and closure (6-10 weeks), each with duration, description, deliverables list, and stakeholders list.
TIBER_PHASES = { "preparation": { "duration_weeks": "4-8", "description": "Scope definition, white-team assembly, threat-intel commission", "deliverables": [ "TLPT scope document (critical/important functions selected)", "White-team Terms of Reference (ToR)", "Threat-intelligence provider engagement letter", "Red-team provider qualification (DORA Art. 27 RTS)", "Notification to lead overseer (TIBER-EU Cyber Team / national authority)", ], "stakeholders": ["white-team-lead", "ciso", "head-of-it-risk", "tlpt-cyber-team"], }, "testing": { "duration_weeks": "12-16", "description": "Threat intelligence + red-team engagement against live production", "deliverables": [ "Targeted Threat Intelligence (TTI) report", "Red-team Test Plan (TTP-mapped to MITRE ATT&CK)", "Live red-team engagement against production systems", "Daily situation reports to white-team", "Test summary findings report", ], "stakeholders": ["red-team", "threat-intel-provider", "white-team-lead"], }, "closure": { "duration_weeks": "6-10", "description": "Findings, remediation, replay, attestation", "deliverables": [ "Findings report with severity-ranked detected gaps", "Remediation plan (90/180/365-day milestones)", "Purple-team replay test (validate fixes)", "Final TLPT attestation (signed by white-team + RT lead)", "Submission to lead overseer for sign-off (Art. 26(7) DORA)", ], "stakeholders": ["white-team-lead", "remediation-owner", "lead-overseer"], }, } - meok_dora_tlpt_planner/server.py:358-361 (registration)The tool is registered with FastMCP via the @mcp.tool() decorator on line 358, which registers 'list_phases' as an MCP tool. The FastMCP instance is created on line 22: 'mcp = FastMCP("meok-dora-tlpt-planner")'.
@mcp.tool() def list_phases() -> dict[str, Any]: """List the 3 TIBER-EU TLPT phases with deliverables.""" return TIBER_PHASES - The TIBER_PHASES constant is also used as a helper data structure reused by the scope_tlpt tool (line 185) which embeds the phases into its scope document output.
TIBER_PHASES = { "preparation": { "duration_weeks": "4-8", "description": "Scope definition, white-team assembly, threat-intel commission", "deliverables": [ "TLPT scope document (critical/important functions selected)", "White-team Terms of Reference (ToR)", "Threat-intelligence provider engagement letter", "Red-team provider qualification (DORA Art. 27 RTS)", "Notification to lead overseer (TIBER-EU Cyber Team / national authority)", ], "stakeholders": ["white-team-lead", "ciso", "head-of-it-risk", "tlpt-cyber-team"], }, "testing": { "duration_weeks": "12-16", "description": "Threat intelligence + red-team engagement against live production", "deliverables": [ "Targeted Threat Intelligence (TTI) report", "Red-team Test Plan (TTP-mapped to MITRE ATT&CK)", "Live red-team engagement against production systems", "Daily situation reports to white-team", "Test summary findings report", ], "stakeholders": ["red-team", "threat-intel-provider", "white-team-lead"], }, "closure": { "duration_weeks": "6-10", "description": "Findings, remediation, replay, attestation", "deliverables": [ "Findings report with severity-ranked detected gaps", "Remediation plan (90/180/365-day milestones)", "Purple-team replay test (validate fixes)", "Final TLPT attestation (signed by white-team + RT lead)", "Submission to lead overseer for sign-off (Art. 26(7) DORA)", ], "stakeholders": ["white-team-lead", "remediation-owner", "lead-overseer"], }, }