At 3:12 a.m., the alert drops: the core business servers no longer respond, access is locked, and exchanges with the SaaS provider return incomprehensible errors. The teams initially assume maintenance. Ten minutes later, monitoring shows a surge of abnormal connections. Then the screens turn black.
This is no longer an incident. It is a crisis.
At that moment, the question is no longer “what is happening?”, but: who leads? who decides? and what do we rely on to survive the first five hours?
In many organisations, large and small, the truth is brutal: management discovers in real time that it has neither a tested plan, nor an operational crisis kit, nor a clear governance model.
The shift is immediate: it is no longer about fixing, but about holding, deciding, documenting and preserving evidence.
A Regulatory Imperative: Crisis Management Is No Longer Optional
European regulations are clear and convergent.
NIS2 requires notification of a significant incident “without undue delay and no later than 24 hours” (Art. 23).
DORA, far more prescriptive, dedicates an entire chapter—Chapter II on ICT Risk Management—to crisis management, incident response, emergency communications and mandatory notifications.
The GDPR, finally, requires notification of any personal data breach within 72 hours.
An organisation unable to activate cyber crisis management is therefore not only operationally impaired:
it becomes non-compliant with three major regulatory frameworks (NIS2, DORA, GDPR).
Critical Communications: Securing Channels Immediately
Recent crises show that communication breakdowns exacerbate the crisis as much as the attack itself.
ENISA recommends using a secure messaging system meeting eight structural criteria: end-to-end encryption, strong authentication, auditability, secure file sharing, open-source code, archiving, multi-OS compatibility, sustainable business model.
This is not optional.
DORA requires crisis communications to be secure and resilient.
NIS2 mandates the use of secure voice / text / video communication channels.
In the first five minutes, one vital reflex is switching to a secure emergency channel, independent from the compromised system.
Activation: Qualifying Quickly, Without Improvisation
Crisis qualification must never rely on intuition or call volume.
ENISA recommends using harmonised severity criteria:
- nature of the incident
- plausible cause
- impact
- critical dependencies affected
- potential propagation
- geographical scale
These criteria trigger escalation, resourcing and notification obligations.
DORA also requires that qualification be integrated into the incident handling procedure.
The Crisis Kit : Making Decisions Under Pressure
The crisis kit is not symbolic: it is vital.
It must include all critical documents offline: on-call plans, roles and responsibilities, escalation matrices, communication templates, authority contact lists, DORA RTS/ITS templates, mapping of critical services and SaaS dependencies, containment procedures, emergency disconnection steps, notification templates.
DORA requires all of this to be predefined, available and tested.
Untested, the crisis kit is useless.
Tested, it becomes decisive.
For any organisation, regardless of size, preparing contractual activation of a qualified incident-response provider is no longer a convenience: it is a resilience requirement and, in the financial sector, a clear supervisory expectation under DORA.
Integrating Realistic Exercises: The Timetable and Injects
The organisations that withstand crises best do not rely solely on a plan.
They train.
ANSSI and ENISA best practices converge: an effective exercise must simulate pressure, confusion, call saturation, rumours on social networks, media pressure, technical constraints (email outage, unreachable systems), and uncertainty.
The central tool is the timetable: a sequence of injects (simulated inputs) defining:
- what information drops
- who receives it
- what must be done
Injects are simulated events sent during the exercise (e.g., calls from media, messages from authorities, ransomware propagation). They reproduce the pressure and uncertainty of a real crisis.
DORA makes these exercises mandatory for operational continuity.
NIS2 requires a national programme of exercises.
Without exercises, the crisis will expose your failures.
With exercises, it will confirm your maturity.
Multi-Year Exercises : A NIS2 Requirement and a DORA Expectation
NIS2 mandates planned exercises.
DORA also requires that response mechanisms and communication procedures be regularly tested.
Crisis Exit: Reconstruction, Not Just Restoration
Returning to normal is never just technical restoration.
It is reconstruction.
Plan for:
- a hotwash (immediate debriefing)
- a consolidated analysis within 30 days
- updated procedures
- strengthened controls
DORA requires the same logic: corrective measures, full documentation, adjustment of internal controls.
An organisation that does not learn prepares the next crisis.
Compliance and Operationalisation Checklist (NIS2, DORA, GDPR)
Have a crisis management policy
Compliant with DORA (Art. 11 and 15), defining governance, responsibilities, crisis thresholds, activation, documentation and post-incident review.
Have a crisis management procedure including:
Organisation and governance
- Defined decision-making and operational crisis units
- Physical and virtual gathering locations
- Backup communication channels (e.g., Olvid) if Teams or internal messaging are unavailable – compliant with DORA
- Roles, responsibilities and alternates identified
Operational logistics
- Crisis room logistics sheet: guest Wi-Fi, conference phone, whiteboard, extra laptops, access badges, food, coffee, fallback options
- Offline access to all critical documentation
Escalation and qualification mechanisms
- Escalation matrix (NIS2 Art. 23; DORA Art. 19)
- Crisis analysis sheet
- Severity qualification matrix
- Flashcards: notification deadlines (NIS2 24h/72h, GDPR 72h, DORA RTS/ITS), RTO & RPO for critical services
Essential references and contacts
- Crisis directory including: authorities, PRIS / forensics providers, cyber insurance, legal counsel, communication teams, critical suppliers, maintenance, security, experts, media — with alternates
- Insurance contracts (including cyber clauses)
- Critical supplier contracts
Structural documentation
- Situation Report template
- Crisis logbook (mandatory for DORA Art. 11.4 traceability)
- Reflex sheets by crisis type (cyber, fire, telecom outage, SaaS outage, identity compromise, data breach)
- Crisis communication sheets by stakeholder group (internal, clients, media, authorities)
- Template emails: crisis room opening / closing
- Meeting minutes email template
- Notification forms for authorities:
- NIS2 (24h Early Warning, 72h Notification, final report)
- GDPR (data breach to the DPA)
- DORA (major incident RTS/ITS: initial report, intermediate report, final report)
Share:
