4.3 Crisis management

Requirement

The relevant entities shall put in place a process for crisis management.

Guidance

• Take into account industry-recognised standards when developing the crisis management process (38).
  • Be aware that each crisis may be different and further analysis may be required on an ad hoc basis.
  • Consider the various aspects (e.g. technical, operational, communication and remediation) of crisis management, including processes, roles and responsibilities.
• Because the escalation of an incident to crisis status depends on an entity’s risk appetite and incident handling capabilities, the entity should define criteria on when a crisis is declared (39). This may refer to incidents that cause serious impact, beyond a certain threshold of tolerance. These criteria may include the following (indicative and non-exhaustive list):
  • the incident poses significant risk to critical assets or operations with high criticality, for example high-severity incidents (e.g. data breaches involving sensitive information);
  • the incident disrupts business operations significantly, for example prolonged downtime, widespread loss of services or significant impact on customer service;
  • the breadth of the incident, that is, whether it affects multiple systems, departments or geographic locations, indicating a wider threat;
  • the potential impact on the entity’s reputation – incidents that could lead to public scrutiny or loss of customer trust should be escalated;
  • the potential impact of the cybersecurity incident on the confidentiality, integrity, authenticity and availability of data;
  • the sophistication and motivations of the threat actors involved. Incidents linked to advanced persistent threats or organised cybercrime may require a higher-level response, beyond the capabilities of the entity;
  • the potential to escalate further (e.g. if vulnerabilities could be exploited again or if malware is spreading).

Examples of evidence

• Crisis management process is in line with documented standards and/or good practices.

Requirement

The relevant entities shall ensure that the crisis management process addresses at least the following elements: (a) roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow; (b) appropriate communication means between the relevant entities and relevant competent authorities; (c) application of appropriate measures to ensure the maintenance of network and information system security in crisis situations. For the purpose of point (b), the flow of information between the relevant entities and relevant competent authorities shall include both obligatory communications, such as incident reports and related timelines and non-obligatory communications.

Guidance

• For crisis communication, consider (indicative, non-exhaustive list):
  • legal obligations for communication, such as timing of communication, in particular referring to requirements for notification;
  • how information will be disseminated to internal and external stakeholders (employees, customers, direct suppliers and service providers, emergency services, etc.) during a crisis;
  • templates for communication;
  • communication channels to be used for each type of stakeholder, considering that:
    • internal and external stakeholders may use different communication channels;
    • normal communication channels might not be safe in crisis mode;
    • channels used to notify and communicate with competent authorities should also be indicated;
  • up-to-date contact information for internal and external stakeholders.

Examples of evidence

• Documented crisis management process.
• List of members of the crisis management team, including their roles, contact information and alternatives.

Requirement

The relevant entities shall implement a process for managing and making use of information received from the CSIRTs or, where applicable, the competent authorities, concerning incidents, vulnerabilities, threats or possible mitigation measures.

Guidance

• Implement a process for managing and making use of information received from the CSIRTs. Consider the following steps (indicative, non-exhaustive list):
  • designate a point of contact with the CSIRT;
  • ensure that the point of contact has sufficient knowledge concerning incidents and threat intelligence.
  • classify incoming information into categories such as incidents, vulnerabilities, threats and mitigation measures.
  • assign priority levels based on severity and potential impact on the entity, if the information is relevant or applicable
  • have the CSIRT contact point review the information for relevance and urgency.
  • validate information against internal logs, threat intelligence feeds and existing security policies.
  • for vulnerabilities and threats, if applicable, collaborate with relevant teams (IT, security, operations) to develop a mitigation strategy;
  • update or create incident response plans based on the nature of the threats or incidents reported in accordance with point 3.5 of the Annex to the regulation.
  • where appropriate, implement the mitigation measures and communicate with the relevant stakeholders in accordance with point 3.5 of the Annex to the regulation.
  • share insights and feedback on incidents and mitigations with the CSIRT on a voluntary basis.

Examples of evidence

• Previous communications with CSIRTs or, where applicable, the competent authorities, for example emails, correspondence and meeting minutes.
• Evidences that the point of contact has sufficient knowledge concerning incidents and threat intelligence.

Requirement

The relevant entities shall test, review and, where appropriate, update the crisis management plan on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Test the crisis management process annually.
• Test the crisis management process through, for example, an exercise or simulation, by (indicative, non-exhaustive list):
  • taking into account past crisis situations;
  • comparing the results of the tests to the objectives defined, for instance the recovery objectives in point 4.1.2 (f) of the Annex to the regulation (e.g. RTOs, RPOs and SDOs) ; and
  • using the results of the comparison to update and improve the crisis management procedure.
• Review and update, if necessary, the crisis management process after a test or following significant incidents or significant changes to operations or risks.
• Review and update the policy on the security of network and information systems and crisis management organisational measures after a test or following significant incidents or significant changes to operations or risks.

Examples of evidence

• Documentation showing how crisis management integrates with the entity’s incident response plans (Annex to the regulation, point 3.5), particularly for ICT-related incidents.
• Documents identifying any previous crises and assessing their likelihood of recurrence and potential impact on business operations.
• Documentation of previous crisis management tests, including the scenarios tested, participants involved and outcomes.
• After-action reports or evaluations from crisis management tests, identifying strengths, weaknesses and areas for improvement.
• Records of internal or external reviews and audits of the crisis management plan, including any findings and corrective actions taken.

Tips: guidance

• Management bodies should approve the crisis management process and, where appropriate, their roles and responsibilities during a crisis should be defined.
• In addition to the elements referred to in point 4.3.2 of the Annex to the regulation the crisis management process might identify (indicative, non-exhaustive list):
  • procedures for declaring a crisis;
  • activation of the crisis management team;
  • escalation paths;
  • emergency procedures, which describe the actions in the event of a crisis; and
  • fall back procedures that describe the actions to be taken to protect essential activities or support services (e.g. alternative temporary locations for bringing the process back to normal operation, recovery or restoration).

Tips: examples of evidence

• Inventory of resources required for crisis management, including backup systems, alternative communication tools and emergency supplies.
• Approved crisis management process.
• A crisis communication plan documented and approved by the management bodies in place and communicated to all personnel. In addition to the elements referred to in point 4.3.2 of the Annex to the regulation and the elements of the above guidance, the plan includes at least (indicative, non-exhaustive list):
  • how information will be disseminated to stakeholders during a crisis;
  • templates for communication; and
  • up-to-date contact information for internal and external stakeholders, including employees, customers, suppliers and emergency services.
• Evidence that personnel are aware of the processes and who to contact in the event of a crisis.
• Records from periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures for managing a crisis.