TenguProtect · Cyber-defence Library
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026

Test accounts, telecoms and simulation setup

G04 · reusable assessment method · Prepare identities and channels that a scoped engagement actually needs.

Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity. Read the approval rules.

1. Decide what is required

Map each service step to a test identity, role, email domain or phone number. Avoid creating accounts or buying credit for unused routes.

Output: account-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

2. Provision controlled test identities

Use client-issued test accounts or Account Creator where its workflow is appropriate and validated. Record ownership, permissions, expiry and a secret-vault reference; never put passwords in the Library.

Output: account-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

3. Configure the selected channels

For VoiceOps verify provider funding, caller identity, callback/webhook delivery, stop controls and retention. Email and SMS require their own approved sender and delivery integration. Voice synthesis is optional.

Output: channel-results.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

4. Perform owned-destination checks

Test one operator-owned destination per required channel, including failure handling. Record a real provider receipt and response; a generated script or queued task is not delivery.

Output: channel-results.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

5. Review and release materials

Review the simulation script, recipients, windows and token-only measurement. Staff exercises do not need real passwords or MFA codes. Release only after the engagement controller approves, then return to the parent playbook.

Output: simulation-script.txt

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.