INTRA/IR/IR008Escalation to crisis management
The passing of a matter to the body that decides for the organization as a whole.
| Control | Jurisdiction | Source | What it establishes | Prerequisite or recommendation |
|---|---|---|---|---|
| IR008/EUMandatory | European Union | Regulation (EU) 2022/2554, articles 11, 13, 17, 18 and 24European Parliament and Council · read 23 Sep 2026 | That a financial entity defines and runs an incident management process with early warning indicators, a classification, named roles per scenario and communication plans, that at least major incidents reach senior management and the management body, that a review after a major incident asks whether the procedures were followed and the actions were effective, and that the response is rehearsed under a testing programme. | For the financial entities it reaches, at least major incidents are reported to relevant senior management and the management body is informed of them, with the impact, the response and the further controls that follow from them. Which body decides for the organization as a whole is left to the entity. |
| IR008/ITMandatory | Italy | Determinazione ACN n. 379907 del 18 dicembre 2025Agenzia per la cybersicurezza nazionale · read 29 Aug 2026 | The baseline security measures an Italian NIS subject has to adopt, among them the recording of remote and administrative access and its central retention, the detection of privilege abuse, and the vetting of the people admitted to the systems that matter. | For a subject in the national NIS register, how communication runs inside the organization is part of the plan, and the involvement of the administrative and management bodies is named as part of it. Those bodies approve the plan itself. |
| Recommended | Germanywhere written | IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026 | What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured. | The handling of a security incident is to be settled with emergency management, and where the organization keeps a separate role for ordinary fault handling that role is brought in too. The interfaces to crisis and emergency management are defined and documented, which staff answer for which task is settled, how they are to be communicated with is settled, and the contact people are to be reachable at all times. |