|
4.3.2.
|
The relevant entities shall ensure that the crisis management process addresses at least the following elements:
|
(a)
|
roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow;
|
|
(b)
|
appropriate communication means between the relevant entities and relevant competent authorities;
|
|
(c)
|
application of appropriate measures to ensure the maintenance of network and information system security in crisis situations.
|
For the purpose of point (b), the flow of information between the relevant entities and relevant competent authorities shall include both obligatory communications, such as incident reports and related timelines, and non-obligatory communications.
|