Article 14Communication
What it says
1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.
2. As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.
3. At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.
DORA, the European Union regulation on digital operational resilience, Article 14
What it means in practice
Crisis communication plans, communication policies and a responsible person.
Entities must have crisis communication plans that enable responsible disclosure of at least major ICT-related incidents or vulnerabilities to clients and counterparts and, as appropriate, to the public. They must also implement communication policies for internal staff and for external stakeholders. The staff policies must take into account the need to differentiate between staff involved in ICT risk management, in particular those responsible for response and recovery, and staff who need to be informed.
At least one person in the entity must be tasked with implementing the communication strategy for ICT-related incidents and with the public and media function for that purpose.
Other articles connect to this one. Article 11(6) requires the crisis communication plans to be tested, and Article 11(7) requires entities other than microenterprises to have a crisis management function whose procedures cover internal and external crisis communications. Article 17(3) requires the incident management process to include communication plans in line with this article. Reporting to the competent authority is a separate duty, in Article 19.
What is in the packs for this
Each one helps with this requirement.
- Excel
DORA Article-to-Control Mapping Library
in DORA ICT Risk & Resilience ReadinessRequirement Library rows RQ-22: Crisis communication. Each gives the provision in plain words, what to show and the documents that help. - Excel
DORA Readiness Self-Assessment
in DORA ICT Risk & Resilience ReadinessReadiness items RM-07: Learning, training and crisis communication. Each rates how ready the entity is, with the evidence and the gap. - Word
ICT Risk Management Framework Document Template
in DORA ICT Risk & Resilience ReadinessStatement FW-58 on crisis communication plans and the person tasked. - Excel
DORA Documentation & Evidence Checklist
in DORA ICT Risk & Resilience ReadinessEvidence records EV-17: The crisis communication plan and the name of the person tasked. Each lists the records a supervisor can ask for. - Excel
Crisis & Recovery Responsibility Matrix
in Business Continuity, Disaster Recovery & Cyber ResilienceResponsibility RA-15 names who discloses incidents to clients, counterparts and the public.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.