4.3.4 The relevant entities shall test, review and, where appropriate, update the crisis management plan …

Requirement

The relevant entities shall test, review and, where appropriate, update the crisis management plan on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Test the crisis management process annually.
• Test the crisis management process through, for example, an exercise or simulation, by (indicative, non-exhaustive list):
  • taking into account past crisis situations;
  • comparing the results of the tests to the objectives defined, for instance the recovery objectives in point 4.1.2 (f) of the Annex to the regulation (e.g. RTOs, RPOs and SDOs) ; and
  • using the results of the comparison to update and improve the crisis management procedure.
• Review and update, if necessary, the crisis management process after a test or following significant incidents or significant changes to operations or risks.
• Review and update the policy on the security of network and information systems and crisis management organisational measures after a test or following significant incidents or significant changes to operations or risks.

Examples of evidence

• Documentation showing how crisis management integrates with the entity’s incident response plans (Annex to the regulation, point 3.5), particularly for ICT-related incidents.
• Documents identifying any previous crises and assessing their likelihood of recurrence and potential impact on business operations.
• Documentation of previous crisis management tests, including the scenarios tested, participants involved and outcomes.
• After-action reports or evaluations from crisis management tests, identifying strengths, weaknesses and areas for improvement.
• Records of internal or external reviews and audits of the crisis management plan, including any findings and corrective actions taken.

Tips: guidance

• Management bodies should approve the crisis management process and, where appropriate, their roles and responsibilities during a crisis should be defined.
• In addition to the elements referred to in point 4.3.2 of the Annex to the regulation the crisis management process might identify (indicative, non-exhaustive list):
  • procedures for declaring a crisis;
  • activation of the crisis management team;
  • escalation paths;
  • emergency procedures, which describe the actions in the event of a crisis; and
  • fall back procedures that describe the actions to be taken to protect essential activities or support services (e.g. alternative temporary locations for bringing the process back to normal operation, recovery or restoration).

Tips: examples of evidence

• Inventory of resources required for crisis management, including backup systems, alternative communication tools and emergency supplies.
• Approved crisis management process.
• A crisis communication plan documented and approved by the management bodies in place and communicated to all personnel. In addition to the elements referred to in point 4.3.2 of the Annex to the regulation and the elements of the above guidance, the plan includes at least (indicative, non-exhaustive list):
  • how information will be disseminated to stakeholders during a crisis;
  • templates for communication; and
  • up-to-date contact information for internal and external stakeholders, including employees, customers, suppliers and emergency services.
• Evidence that personnel are aware of the processes and who to contact in the event of a crisis.
• Records from periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures for managing a crisis.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• ENISA -