Comparison
CIS v8.1 vs DORA
CIS Controls v8.1 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of CIS Controls v8.1 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 17 map to something in CIS v8.1, 1 are only loosely related, and 4 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to CIS v8.1 (4)
| DORA | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 2 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Art.16 | Simplified ICT risk management framework | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Chapter IV: Resilience testing · 1 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | No mapping in our data | — | No mapping to CIS v8.1 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| DORA | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.6 | ICT risk management framework | CIS 14.1CIS 14.9 | Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
Mapped (17)
| DORA | Requirement | Match | CIS v8.1 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 8 | ||||
| Art.5 | Governance and organisation | Editorial | CIS 14.2CIS 14.3CIS 14.4+4 | Same topic: Awareness & Training (editorial pick) |
| Art.8 | Identification | Editorial | CIS 1.1CIS 1.2CIS 1.3+20 | Same topic: Asset Management (editorial pick) |
| Art.9 | Protection and prevention | Editorial | CIS 13.1CIS 13.6CIS 3.1+33 | Same topic: Cont. Monitoring, Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | CIS 8.11CIS 13.2CIS 13.3+5 | Same topic: Anomaly Detection, Intrusion Detection (editorial pick) |
| Art.11 | Response and recovery | Editorial | CIS 17.1CIS 17.4CIS 17.5+3 | Same topic: Incident Response (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | CIS 11.2CIS 11.3CIS 11.4+2 | Same topic: Backup & Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | CIS 17.8CIS 14.1CIS 14.2+7 | Same topic: Lessons Learned, Awareness & Training (editorial pick) |
| Art.14 | Communication | Editorial | CIS 17.2CIS 17.6 | Same topic: Communication (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | CIS 17.1CIS 17.4CIS 17.5+4 | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | CIS 17.1CIS 17.3CIS 17.4+3 | Same topic: Incident Response, Reporting (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | CIS 17.3 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 3 | ||||
| Art.25 | Testing of ICT tools and systems | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | CIS 7.1CIS 7.2CIS 7.5+8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | CIS 15.2CIS 15.1CIS 15.3+2 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | CIS 15.2 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | CIS 15.1CIS 15.3CIS 15.4+3 | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) |
Of 153 CIS Controls v8.1 requirements, 109 map to something in DORA, 34 are only loosely related, and 10 have no mapping in our data.
CIS's own published crosswalk covers 49 of 153 safeguards; ControlMapping mapped the rest editorially, with a reason for each, so check those links before relying on them.
Likely new work: CIS v8.1 requirements with no mapping to DORA (10)
| CIS v8.1 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| 2. Inventory and Control of Software Assets · 1 | ||||
| CIS 2.5 | Allowlist Authorized Software | No mapping in our data | — | No mapping to DORA in our data. |
| 16. Application Software Security · 9 | ||||
| CIS 16.1 | Establish and Maintain a Secure Application Development Process | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.2 | Establish and Maintain a Process to Accept and Address Software Vulnerabilities | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.3 | Perform Root Cause Analysis on Security Vulnerabilities | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.5 | Use Up-to-Date and Trusted Third-Party Software Components | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.8 | Separate Production and Non-Production Systems | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.9 | Train Developers in Application Security Concepts and Secure Coding | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.11 | Leverage Vetted Modules or Services for Application Security Components | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.13 | Conduct Application Penetration Testing | No mapping in our data | — | No mapping to DORA in our data. |
| CIS 16.14 | Conduct Threat Modeling | No mapping in our data | — | No mapping to DORA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (34)
| CIS v8.1 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| 2. Inventory and Control of Software Assets · 2 | ||||
| CIS 2.6 | Allowlist Authorized Libraries | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 2.7 | Allowlist Authorized Scripts | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| 3. Data Protection · 1 | ||||
| CIS 3.13 | Deploy a Data Loss Prevention Solution | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| 4. Secure Configuration of Enterprise Assets and Software · 10 | ||||
| CIS 4.1 | Establish and Maintain a Secure Configuration Process | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 4.2 | Establish and Maintain a Secure Configuration Process for Network Infrastructure | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 4.3 | Configure Automatic Session Locking on Enterprise Assets | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 4.6 | Securely Manage Enterprise Assets and Software | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 4.7 | Manage Default Accounts on Enterprise Assets and Software | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 4.9 | Configure Trusted DNS Servers on Enterprise Assets | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| CIS 4.10 | Enforce Automatic Device Lockout on Portable End-User Devices | Art.9(4)(c)Art.28(8)Art.30(2) | Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping | |
| CIS 4.11 | Enforce Remote Wipe Capability on Portable End-User Devices | Art.9(4)(c)Art.28(8)Art.30(2) | Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping | |
| CIS 4.12 | Separate Enterprise Workspaces on Mobile End-User Devices | Art.9(4)(c)Art.28(8)Art.30(2) | Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping | |
| 8. Audit Log Management · 1 | ||||
| CIS 8.6 | Collect DNS Query Audit Logs | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| 9. Email and Web Browser Protections · 7 | ||||
| CIS 9.1 | Ensure Use of Only Fully Supported Browsers and Email Clients | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
| CIS 9.2 | Use DNS Filtering Services | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| CIS 9.3 | Maintain and Enforce Network-Based URL Filters | Art.9(4)(b)Art.28(8)Art.30(2) | Only shares CSF PR.IR-01: related, not a mapping | |
| CIS 9.4 | Restrict Unnecessary or Unauthorized Browser and Email Client Extensions | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
| CIS 9.5 | Implement DMARC | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
| CIS 9.6 | Block Unnecessary File Types | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
| CIS 9.7 | Deploy and Maintain Email Server Anti-Malware Protections | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
| 10. Malware Defenses · 7 | ||||
| CIS 10.1 | Deploy and Maintain Anti-Malware Software | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 10.2 | Configure Automatic Anti-Malware Signature Updates | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 10.3 | Disable Autorun and Autoplay for Removable Media | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 10.4 | Configure Automatic Anti-Malware Scanning of Removable Media | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 10.5 | Enable Anti-Exploitation Features | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 10.6 | Centrally Manage Anti-Malware Software | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| CIS 10.7 | Use Behavior-Based Anti-Malware Software | Art.9(1)Art.10(3)Art.10(1) | Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping | |
| 12. Network Infrastructure Management · 1 | ||||
| CIS 12.7 | Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure | Art.9(4)(b)Art.9(4)(c)Art.9(4)(d)+2 | Only shares CSF PR.IR-01, PR.AA-05, PR.AA-03: related, not a mapping | |
| 13. Network Monitoring and Defense · 2 | ||||
| CIS 13.5 | Manage Access Control for Remote Assets | Art.9(4)(b)Art.9(4)(c)Art.9(4)(d)+2 | Only shares CSF PR.IR-01, PR.AA-05, PR.AA-03: related, not a mapping | |
| CIS 13.10 | Perform Application Layer Filtering | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| 16. Application Software Security · 3 | ||||
| CIS 16.7 | Use Standard Hardening Configuration Templates for Application Infrastructure | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CIS 16.10 | Apply Secure Design Principles in Application Architectures | Art.9(4)(b)Art.9(4)(d)Art.28(8)+1 | Only shares CSF PR.IR-01, PR.AA-03: related, not a mapping | |
| CIS 16.12 | Implement Code-Level Security Checks | Art.9(4)(b)Art.9(4)(d)Art.28(8)+1 | Only shares CSF PR.IR-01, PR.AA-03: related, not a mapping | |
Mapped (109)
| CIS v8.1 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| 1. Inventory and Control of Enterprise Assets · 5 | ||||
| CIS 1.1 | Establish and Maintain Detailed Enterprise Asset Inventory | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 1.2 | Address Unauthorized Assets | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 1.3 | Utilize an Active Discovery Tool | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 1.4 | Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 1.5 | Use a Passive Asset Discovery Tool | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| 2. Inventory and Control of Software Assets · 4 | ||||
| CIS 2.1 | Establish and Maintain a Software Inventory | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 2.2 | Ensure Authorized Software is Currently Supported | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| CIS 2.3 | Address Unauthorized Software | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 2.4 | Utilize Automated Software Inventory Tools | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| 3. Data Protection · 13 | ||||
| CIS 3.1 | Establish and Maintain a Data Management Process | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| CIS 3.2 | Establish and Maintain a Data Inventory | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| CIS 3.3 | Configure Data Access Control Lists | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 3.4 | Enforce Data Retention | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| CIS 3.5 | Securely Dispose of Data | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| CIS 3.6 | Encrypt Data on End-User Devices | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| CIS 3.7 | Establish and Maintain a Data Classification Scheme | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| CIS 3.8 | Document Data Flows | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| CIS 3.9 | Encrypt Data on Removable Media | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| CIS 3.10 | Encrypt Sensitive Data in Transit | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| CIS 3.11 | Encrypt Sensitive Data at Rest | Editorial | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Same topic: Data Protection, Encryption (editorial pick) |
| CIS 3.12 | Segment Data Processing and Storage Based on Sensitivity | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| CIS 3.14 | Log Sensitive Data Access | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| 4. Secure Configuration of Enterprise Assets and Software · 2 | ||||
| CIS 4.4 | Implement and Manage a Firewall on Servers | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 4.5 | Implement and Manage a Firewall on End-User Devices | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| 5. Account Management · 6 | ||||
| CIS 5.1 | Establish and Maintain an Inventory of Accounts | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 5.2 | Use Unique Passwords | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 5.3 | Disable Dormant Accounts | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 5.4 | Restrict Administrator Privileges to Dedicated Administrator Accounts | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| CIS 5.5 | Establish and Maintain an Inventory of Service Accounts | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 5.6 | Centralize Account Management | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| 6. Access Control Management · 8 | ||||
| CIS 6.1 | Establish an Access Granting Process | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 6.2 | Establish an Access Revoking Process | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 6.3 | Require MFA for Externally-Exposed Applications | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.4 | Require MFA for Remote Network Access | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.5 | Require MFA for Administrative Access | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| CIS 6.6 | Establish and Maintain an Inventory of Authentication and Authorization Systems | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 6.7 | Centralize Access Control | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 6.8 | Define and Maintain Role-Based Access Control | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| 7. Continuous Vulnerability Management · 7 | ||||
| CIS 7.1 | Establish and Maintain a Vulnerability Management Process | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.2 | Establish and Maintain a Remediation Process | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.3 | Perform Automated Operating System Patch Management | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| CIS 7.4 | Perform Automated Application Patch Management | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| CIS 7.5 | Perform Automated Vulnerability Scans of Internal Enterprise Assets | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.6 | Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 7.7 | Remediate Detected Vulnerabilities | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| 8. Audit Log Management · 11 | ||||
| CIS 8.1 | Establish and Maintain an Audit Log Management Process | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.2 | Collect Audit Logs | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.3 | Ensure Adequate Audit Log Storage | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.4 | Standardize Time Synchronization | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.5 | Collect Detailed Audit Logs | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.7 | Collect URL Request Audit Logs | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.8 | Collect Command-Line Audit Logs | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.9 | Centralize Audit Logs | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC (editorial pick) |
| CIS 8.10 | Retain Audit Logs | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CIS 8.11 | Conduct Audit Log Reviews | Editorial | Art.10(1) | Same topic: Anomaly Detection (editorial pick) |
| CIS 8.12 | Collect Service Provider Logs | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| 11. Data Recovery · 5 | ||||
| CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Art.11(3)Art.11(6)Art.12(4)+1 | Same topic: Recovery Planning, Disaster Recovery (editorial pick) |
| CIS 11.2 | Perform Automated Backups | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.3 | Protect Recovery Data | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.4 | Establish and Maintain an Isolated Instance of Recovery Data | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| CIS 11.5 | Test Data Recovery | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| 12. Network Infrastructure Management · 7 | ||||
| CIS 12.1 | Ensure Network Infrastructure is Up-to-Date | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| CIS 12.2 | Establish and Maintain a Secure Network Architecture | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.3 | Securely Manage Network Infrastructure | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.4 | Establish and Maintain Architecture Diagram(s) | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.5 | Centralize Network Authentication, Authorization, and Auditing (AAA) | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| CIS 12.6 | Use of Secure Network Management and Communication Protocols | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| 13. Network Monitoring and Defense · 9 | ||||
| CIS 13.1 | Centralize Security Event Alerting | Editorial | Art.9(1)Art.10(2)Art.10(3) | Same topic: Cont. Monitoring, SIEM / SOC (editorial pick) |
| CIS 13.2 | Deploy a Host-Based Intrusion Detection Solution | Editorial | Art.10(1)Art.10(2) | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.3 | Deploy a Network Intrusion Detection Solution | Editorial | Art.10(1)Art.10(2) | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.4 | Perform Traffic Filtering Between Network Segments | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 13.6 | Collect Network Traffic Flow Logs | Editorial | Art.9(1)Art.10(3) | Same topic: Cont. Monitoring (editorial pick) |
| CIS 13.7 | Deploy a Host-Based Intrusion Prevention Solution | Editorial | Art.10(1)Art.10(2) | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.8 | Deploy a Network Intrusion Prevention Solution | Editorial | Art.10(1)Art.10(2) | Same topic: Intrusion Detection (editorial pick) |
| CIS 13.9 | Deploy Port-Level Access Control | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CIS 13.11 | Tune Security Event Alerting Thresholds | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC (editorial pick) |
| 14. Security Awareness and Skills Training · 9 | ||||
| CIS 14.1 | Establish and Maintain a Security Awareness Program | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.2 | Train Workforce Members to Recognize Social Engineering Attacks | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.3 | Train Workforce Members on Authentication Best Practices | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.4 | Train Workforce on Data Handling Best Practices | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.5 | Train Workforce Members on Causes of Unintentional Data Exposure | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.6 | Train Workforce Members on Recognizing and Reporting Security Incidents | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.7 | Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.8 | Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| CIS 14.9 | Conduct Role-Specific Security Awareness and Skills Training | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| 15. Service Provider Management · 7 | ||||
| CIS 15.1 | Establish and Maintain an Inventory of Service Providers | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| CIS 15.3 | Classify Service Providers | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.4 | Ensure Service Provider Contracts Include Security Requirements | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.5 | Assess Service Providers | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.6 | Monitor Service Providers | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| CIS 15.7 | Securely Decommission Service Providers | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 16. Application Software Security · 2 | ||||
| CIS 16.4 | Establish and Manage an Inventory of Third-Party Software Components | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CIS 16.6 | Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| 17. Incident Response Management · 9 | ||||
| CIS 17.1 | Designate Personnel to Manage Incident Handling | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.2 | Establish and Maintain Contact Information for Reporting Security Incidents | Editorial | Art.14(1)Art.14(2)Art.17(3)(d) | Same topic: Communication (editorial pick) |
| CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
| CIS 17.4 | Establish and Maintain an Incident Response Process | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.5 | Assign Key Roles and Responsibilities | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.6 | Define Mechanisms for Communicating During Incident Response | Editorial | Art.11(2)(e)Art.11(7)Art.14(1)+2 | Same topic: Comms & Restore, Communication (editorial pick) |
| CIS 17.7 | Conduct Routine Incident Response Exercises | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| CIS 17.8 | Conduct Post-Incident Reviews | Editorial | Art.13(2)Art.13(3) | Same topic: Lessons Learned (editorial pick) |
| CIS 17.9 | Establish and Maintain Security Incident Thresholds | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| 18. Penetration Testing · 5 | ||||
| CIS 18.1 | Establish and Maintain a Penetration Testing Program | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.2 | Perform Periodic External Penetration Tests | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.3 | Remediate Penetration Test Findings | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.4 | Validate Security Measures | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CIS 18.5 | Perform Periodic Internal Penetration Tests | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
By topic
Both cover (27):
Awareness & TrainingSupply Chain RiskAsset ManagementData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseCommunicationReportingRecovery PlanningLessons LearnedComms & RestoreDisaster RecoveryVendor Risk Mgmt
Only CIS v8.1 (11):
Endpoint ProtectionSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityDNS SecurityWAFDLPAPI Security
Only DORA (12):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.