Art. 88(3)

AI/ML training-data poisoning (primary: Art. 88(1)) cascades to 88(3) — TLPT every 3 years should validate ML pipeline integrity against adversarial-input tests.

Rootkit detection (primary: Art. 88(1)) cascades to 88(3) — TLPT 3-yearly cadence is exactly the offensive-testing discipline that surfaces persistent rootkits between security audits.

PNT-geofenced malware detection (primary: Art. 88(1)) cascades to 88(3) — TLPT can include orbital-trajectory behavioral testing across the 3-year cadence.

Hardware-design-flaw exploitation (primary: Art. 88(1)) cascades to 88(3) — pre-launch + 3-yearly TLPT is the cadence at which design-flaw classes are stressed by external testers.

Code-flaw exploitation (primary: Art. 88(1)) cascades to 88(3) — TLPT prior-to-launch and every 3 years validates that code-defect classes remain detected by operator testing.

FSW code-flaw testing (primary: Art. 88(1)) cascades to 88(3) — pre-launch TLPT is the canonical case for FSW security-test cadence.

OS-layer testing (primary: Art. 88(1)) cascades to 88(3) — TLPT 3-yearly cadence covers kernel-and-driver attack surfaces.

Malicious-code testing (primary: Art. 88(1)) cascades to 88(3) — pre-launch and 3-yearly TLPT validates that update/file-transfer/maintenance pathways do not accept malicious payloads.

Rootkit testing (primary: Art. 88(1)) cascades to 88(3) — out-of-band attestation testing in TLPT cadence is the operator discipline that surfaces rootkit persistence.

AI/ML training-data testing (primary: Art. 88(1)) cascades to 88(3) — TLPT cadence covers ML pipeline adversarial-input scenarios.

Side-channel testing (primary: Art. 88(1)) cascades to 88(3) — periodic side-channel and fault-injection testing falls within the TLPT 3-yearly framework.

Side-channel exfiltration testing (primary: Art. 88(1)) cascades to 88(3) — TLPT 3-yearly cadence covers side-channel and emanation testing as part of broader penetration testing.

Dev-environment compromise testing (primary: Art. 88(1)) cascades to 88(3) — TLPT scope can include dev-pipeline integrity validation against the 3-yearly cadence.

Software-dependency testing (primary: Art. 88(1)) cascades to 88(3) — TLPT can include dependency provenance testing across the 3-yearly cadence.

Hypervisor-escape testing (primary: Art. 88(1)) cascades to 88(3) — TLPT 3-yearly cadence covers separation-kernel boundary fuzzing on operator products.

Backdoor detection (primary: Art. 88(1)) cascades to 88(3) — TLPT prior-to-launch + 3-yearly is the canonical operator-side cadence for adversary-perspective backdoor surfacing.

Hardware-backdoor testing (primary: Art. 88(1)) cascades to 88(3) — TLPT cadence with hardware-attestation testing surfaces durable backdoors.

Software-backdoor testing (primary: Art. 88(1)) cascades to 88(3) — TLPT cadence with adversary-emulating code review surfaces nonpublic command paths.

Security-testing-tool reconnaissance (primary: Art. 88(1)) cascades to 88(3) — TLPT 3-yearly cadence is the high-level discipline that surfaces gaps in operator's own testing programme.

Known-vulnerability reconnaissance (primary: Art. 88(1)) cascades to 88(3) — TLPT validates that operator products are tested against known-vuln catalogs at the 3-yearly cadence.