Article 13 Digital Operational Resilience Act (DORA), Communication

Article 13 of the Digital Operational Resilience Act (DORA) focuses on the essential communication strategies that financial entities must establish as part of their ICT risk management framework. These strategies are crucial for managing and disclosing ICT-related incidents and vulnerabilities effectively. This article outlines the requirements for communication plans, policies, and responsibilities to ensure that financial entities can respond to ICT risks in a structured and transparent manner.

Communication Plans For ICT-Related Incidents

As mandated by Article 5(1) of DORA, financial entities are required to have robust communication plans as part of their ICT risk management framework. These plans must enable the responsible disclosure of ICT-related incidents or significant vulnerabilities. The aim is to ensure that clients, counterparts, and the public are appropriately informed about any ICT issues that may impact their operations or services.

The communication plans should outline the procedures for disclosing incidents or vulnerabilities in a timely and clear manner. This involves determining the appropriate channels and methods for communicating with different stakeholders. For clients and counterparts, the focus is on ensuring that they are promptly informed about incidents that could affect their interactions with the financial entity. Public disclosure should be managed in a way that maintains transparency while minimizing potential damage to the entity’s reputation and operations.

Communication Policies For Staff and External Stakeholders

In addition to the communication plans, Article 13 requires financial entities to implement specific communication policies for both staff and external stakeholders. These policies must be integrated into the broader ICT risk management framework and should cater to the needs of different groups within the organization.

Communication policies for staff should differentiate between those involved in ICT risk management, such as response and recovery teams, and those who need to be informed about incidents. This distinction is crucial for ensuring that information is disseminated appropriately and that staff members are aware of their roles and responsibilities in the event of an ICT incident. For staff involved in managing ICT risks, the communication policies should provide detailed guidance on how to handle and report incidents. For other staff members, the policies should focus on keeping them informed without overwhelming them with technical details.

For external stakeholders, the policies should outline how information about ICT incidents and vulnerabilities is communicated to parties outside the organization, including clients, partners, regulators, and the media. This ensures that external stakeholders are kept up-to-date and can take necessary actions based on the information provided.

Designation of a Communication Officer

Article 13 also stipulates that at least one person within the financial entity must be designated to implement the communication strategy for ICT-related incidents. This individual, often referred to as the communication officer or spokesperson, is responsible for managing all aspects of communication related to ICT incidents. Their role includes serving as the primary contact for public and media inquiries.

The communication officer must be well-versed in the entity’s communication plans and policies and should have the expertise to handle sensitive information related to ICT incidents. This role involves coordinating internal and external communication efforts, ensuring consistency in messaging, and maintaining transparency while managing potential reputational risks.

In summary, Article 13 of DORA emphasizes the importance of having well-defined communication strategies as part of the ICT risk management framework for financial entities. Effective communication plans, tailored policies for staff and external stakeholders, and a designated communication officer are essential components in managing ICT risks and maintaining trust with clients, counterparts, and the public. By adhering to these requirements, financial entities can better navigate the complexities of ICT-related incidents and vulnerabilities, ensuring a more resilient and transparent operational environment.