[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:dora\u002F14":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"dora","14","Article 14","Communication",0,"Digital Operational Resilience Act","**What it asks for.** Financial entities must have crisis communication plans that enable responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients, counterparts and the public as appropriate. They must also have communication policies for internal staff and external stakeholders.\n\n**In practice.** Policies distinguish between staff involved in ICT risk management, in particular response and recovery, and staff who need to be informed. At least one person must be tasked with implementing the communication strategy for ICT-related incidents and fulfilling the public and media function. Doing this well means pre-approved message templates, defined approval chains, contact lists for clients, counterparts and authorities, and coordination with the incident reporting process under Article 19. Exercises should include the communication function. Evidence includes the plan, named roles and records from tests or real incidents.\n\n**Common gaps.** Common gaps are communication plans that are not linked to incident classification, untested media and client notification processes, and no clear owner during out-of-hours incidents.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022R2554#art_14","Read the article on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]