4.3.1 The relevant entities shall put in place a process for crisis management.

Requirement

The relevant entities shall put in place a process for crisis management.

Guidance

• Take into account industry-recognised standards when developing the crisis management process (38).
  • Be aware that each crisis may be different and further analysis may be required on an ad hoc basis.
  • Consider the various aspects (e.g. technical, operational, communication and remediation) of crisis management, including processes, roles and responsibilities.
• Because the escalation of an incident to crisis status depends on an entity’s risk appetite and incident handling capabilities, the entity should define criteria on when a crisis is declared (39). This may refer to incidents that cause serious impact, beyond a certain threshold of tolerance. These criteria may include the following (indicative and non-exhaustive list):
  • the incident poses significant risk to critical assets or operations with high criticality, for example high-severity incidents (e.g. data breaches involving sensitive information);
  • the incident disrupts business operations significantly, for example prolonged downtime, widespread loss of services or significant impact on customer service;
  • the breadth of the incident, that is, whether it affects multiple systems, departments or geographic locations, indicating a wider threat;
  • the potential impact on the entity’s reputation – incidents that could lead to public scrutiny or loss of customer trust should be escalated;
  • the potential impact of the cybersecurity incident on the confidentiality, integrity, authenticity and availability of data;
  • the sophistication and motivations of the threat actors involved. Incidents linked to advanced persistent threats or organised cybercrime may require a higher-level response, beyond the capabilities of the entity;
  • the potential to escalate further (e.g. if vulnerabilities could be exploited again or if malware is spreading).

Examples of evidence

• Crisis management process is in line with documented standards and/or good practices.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• ENISA -