Article 14Communication
1. As part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.
2. As part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.
3. At least one person in the financial entity shall be tasked with implementing the communication strategy for ICT-related incidents and fulfil the public and media function for that purpose.
DORA, the European Union regulation on digital operational resilience, Article 14
Crisis communication plans, communication policies and a responsible person.
Entities must have crisis communication plans that enable responsible disclosure of at least major ICT-related incidents or vulnerabilities to clients and counterparts and, as appropriate, to the public. They must also implement communication policies for internal staff and for external stakeholders. The staff policies must take into account the need to differentiate between staff involved in ICT risk management, in particular those responsible for response and recovery, and staff who need to be informed.
At least one person in the entity must be tasked with implementing the communication strategy for ICT-related incidents and with the public and media function for that purpose.
Other articles connect to this one. Article 11(6) requires the crisis communication plans to be tested, and Article 11(7) requires entities other than microenterprises to have a crisis management function whose procedures cover internal and external crisis communications. Article 17(3) requires the incident management process to include communication plans in line with this article. Reporting to the competent authority is a separate duty, in Article 19.
What is in the packs for this
Each one helps with this requirement.
DORA Article-to-Control Mapping LibraryExcel
in DORA ICT Risk & Resilience Readiness
Requirement Library rows RQ-22: each gives the provision in plain words, what an entity must be able to show and the documents that help.
DORA Readiness Self-AssessmentExcel
in DORA ICT Risk & Resilience Readiness
Readiness items RM-07 rate how ready the entity is for the provision, with the evidence behind each rating and the gap.
ICT Risk Management Framework Document TemplateWord
in DORA ICT Risk & Resilience Readiness
Statement FW-58 on crisis communication plans and the person tasked.
DORA Documentation & Evidence ChecklistExcel
in DORA ICT Risk & Resilience Readiness
Evidence records EV-17: the records a supervisor can ask for under the provision, with who keeps them and for how long.
Crisis & Recovery Responsibility MatrixExcel
in Cyber Resilience & Recovery
Responsibility RA-15 names who discloses incidents to clients, counterparts and the public.
Text: Regulation (EU) 2022/2554, as published in the Official Journal of the European Union, from EUR-Lex. Only the Official Journal text is authentic.