4.3.2 The relevant entities shall ensure that the crisis management process addresses at least the …

Requirement

The relevant entities shall ensure that the crisis management process addresses at least the following elements: (a) roles and responsibilities for personnel and, where appropriate, suppliers and service providers, specifying the allocation of roles in crisis situations, including specific steps to follow; (b) appropriate communication means between the relevant entities and relevant competent authorities; (c) application of appropriate measures to ensure the maintenance of network and information system security in crisis situations. For the purpose of point (b), the flow of information between the relevant entities and relevant competent authorities shall include both obligatory communications, such as incident reports and related timelines and non-obligatory communications.

Guidance

• For crisis communication, consider (indicative, non-exhaustive list):
  • legal obligations for communication, such as timing of communication, in particular referring to requirements for notification;
  • how information will be disseminated to internal and external stakeholders (employees, customers, direct suppliers and service providers, emergency services, etc.) during a crisis;
  • templates for communication;
  • communication channels to be used for each type of stakeholder, considering that:
    • internal and external stakeholders may use different communication channels;
    • normal communication channels might not be safe in crisis mode;
    • channels used to notify and communicate with competent authorities should also be indicated;
  • up-to-date contact information for internal and external stakeholders.

Examples of evidence

• Documented crisis management process.
• List of members of the crisis management team, including their roles, contact information and alternatives.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.