Comparison
CMMC vs DORA
CMMC Level 2 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of CMMC Level 2 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 20 map to something in CMMC, 1 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to CMMC (1)
| DORA | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to CMMC in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| DORA | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Chapter V: ICT third-party risk · 1 | ||||
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | RA.L2-3.11.1 | Only shares CSF GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping | |
Mapped (20)
| DORA | Requirement | Match | CMMC | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 10 | ||||
| Art.5 | Governance and organisation | Editorial | RA.L2-3.11.1CA.L2-3.12.1AT.L2-3.2.1+2 | Same topic: Risk Management, Compliance, Awareness & Training (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | RA.L2-3.11.1PE.L2-3.10.1PE.L2-3.10.2+5 | Same topic: Risk Management, Physical Security (editorial pick) |
| Art.8 | Identification | Editorial | CM.L2-3.4.1MP.L2-3.8.4RA.L2-3.11.1+3 | Same topic: Asset Management, Data Classification, Risk Assessment (editorial pick) |
| Art.9 | Protection and prevention | Editorial | SI.L2-3.14.6SI.L2-3.14.7MP.L2-3.8.3+11 | Same topic: Cont. Monitoring, Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | SI.L2-3.14.6SI.L2-3.14.7AT.L2-3.2.3+3 | Same topic: Intrusion Detection, Anomaly Detection, Insider Threat (editorial pick) |
| Art.11 | Response and recovery | Editorial | IR.L2-3.6.1IR.L2-3.6.3 | Same topic: Incident Response (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | MP.L2-3.8.9 | Same topic: Backup & Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | SI.L2-3.14.3AU.L2-3.3.6IR.L2-3.6.1+3 | Same topic: Threat Intelligence, Forensics, Lessons Learned (editorial pick) |
| Art.14 | Communication | Editorial | IR.L2-3.6.2 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | RA.L2-3.11.1 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | IR.L2-3.6.1IR.L2-3.6.3AU.L2-3.3.6 | Same topic: Incident Response, Forensics (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | IR.L2-3.6.1IR.L2-3.6.2IR.L2-3.6.3 | Same topic: Incident Response, Reporting (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | IR.L2-3.6.2 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | RA.L2-3.11.1 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | RA.L2-3.11.2RA.L2-3.11.3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 2 | ||||
| Art.28 | General principles | Editorial | AC.L2-3.1.20 | Same topic: Cloud Security (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | AC.L2-3.1.20 | Same topic: Cloud Security (editorial pick) |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Editorial | SI.L2-3.14.3 | Same topic: Threat Intelligence (editorial pick) |
Of 110 CMMC Level 2 requirements, 47 map to something in DORA, 46 are only loosely related, and 17 have no mapping in our data.
Likely new work: CMMC requirements with no mapping to DORA (17)
| CMMC | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| AC Access Control · 3 | ||||
| AC.L2-3.1.9 | Privacy & Security Notices | No mapping in our data | — | No mapping to DORA in our data. |
| AC.L2-3.1.10 | Session Lock | No mapping in our data | — | No mapping to DORA in our data. |
| AC.L2-3.1.22 | Control Public Information | No mapping in our data | — | No mapping to DORA in our data. |
| AU Audit and Accountability · 1 | ||||
| AU.L2-3.3.4 | Audit Failure Alerting | No mapping in our data | — | No mapping to DORA in our data. |
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.2 | Plan of Action | No mapping in our data | — | No mapping to DORA in our data. |
| MA Maintenance · 2 | ||||
| MA.L2-3.7.5 | Nonlocal Maintenance | No mapping in our data | — | No mapping to DORA in our data. |
| MA.L2-3.7.6 | Maintenance Personnel | No mapping in our data | — | No mapping to DORA in our data. |
| MP Media Protection · 4 | ||||
| MP.L2-3.8.1 | Media Protection | No mapping in our data | — | No mapping to DORA in our data. |
| MP.L2-3.8.2 | Media Access | No mapping in our data | — | No mapping to DORA in our data. |
| MP.L2-3.8.7 | Removable Media | No mapping in our data | — | No mapping to DORA in our data. |
| MP.L2-3.8.8 | Shared Media | No mapping in our data | — | No mapping to DORA in our data. |
| PS Personnel Security · 1 | ||||
| PS.L2-3.9.2 | Personnel Actions | No mapping in our data | — | No mapping to DORA in our data. |
| SC System and Communications Protection · 5 | ||||
| SC.L2-3.13.9 | Connections Termination | No mapping in our data | — | No mapping to DORA in our data. |
| SC.L2-3.13.12 | Collaborative Device Control | No mapping in our data | — | No mapping to DORA in our data. |
| SC.L2-3.13.13 | Mobile Code | No mapping in our data | — | No mapping to DORA in our data. |
| SC.L2-3.13.14 | Voice over Internet Protocol | No mapping in our data | — | No mapping to DORA in our data. |
| SC.L2-3.13.15 | Communications Authenticity | No mapping in our data | — | No mapping to DORA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (46)
| CMMC | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| AC Access Control · 11 | ||||
| AC.L2-3.1.3 | Control CUI Flow | Art.9(1)Art.9(2)Art.9(3)(c)+5 | Only shares CSF DE.CM-09, PR.DS-10: related, not a mapping | |
| AC.L2-3.1.4 | Separation of Duties | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.8 | Unsuccessful Logon Attempts | Art.9(4)(d) | Only shares CSF PR.AA-03: related, not a mapping | |
| AC.L2-3.1.11 | Session Termination | Art.9(4)(d) | Only shares CSF PR.AA-03: related, not a mapping | |
| AC.L2-3.1.12 | Control Remote Access | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.14 | Remote Access Routing | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.15 | Privileged Remote Access | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.16 | Wireless Access Authorization | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.17 | Wireless Access Protection | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.18 | Mobile Device Connection | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC.L2-3.1.21 | Portable Storage Use | Art.8(1)Art.8(4)Art.8(6)+2 | Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping | |
| AU Audit and Accountability · 3 | ||||
| AU.L2-3.3.3 | Event Review | Art.10(3)Art.9(1)Art.10(1)+1 | Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.PS-04: related, not a mapping | |
| AU.L2-3.3.8 | Audit Protection | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Only shares CSF PR.DS-10: related, not a mapping | |
| AU.L2-3.3.9 | Audit Management | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Only shares CSF PR.DS-10: related, not a mapping | |
| CA Security Assessment · 2 | ||||
| CA.L2-3.12.3 | Security Control Monitoring | Art.10(3)Art.9(1)Art.10(1)+5 | Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-09…: related, not a mapping | |
| CA.L2-3.12.4 | System Security Plan | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF ID.AM-08: related, not a mapping | |
| CM Configuration Management · 8 | ||||
| CM.L2-3.4.2 | Security Configuration Enforcement | Art.9(1)Art.10(1)Art.10(3)+2 | Only shares CSF DE.CM-09: related, not a mapping | |
| CM.L2-3.4.3 | System Change Management | Art.9(1)Art.10(1)Art.10(3)+3 | Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping | |
| CM.L2-3.4.4 | Security Impact Analysis | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.5 | Access Restrictions for Change | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.6 | Least Functionality | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.7 | Nonessential Functionality | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.8 | Application Execution Policy | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM.L2-3.4.9 | User-Installed Software | Art.10(3)Art.9(1)Art.10(1)+5 | Only shares CSF DE.AE-03, DE.CM-01, DE.CM-03, DE.CM-09…: related, not a mapping | |
| IA Identification and Authentication · 10 | ||||
| IA.L2-3.5.1 | Identification | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.2 | Authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.4 | Replay-Resistant Authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.5 | Identifier Reuse | Art.9(4)(c) | Only shares CSF PR.AA-01: related, not a mapping | |
| IA.L2-3.5.6 | Identifier Handling | Art.9(4)(c) | Only shares CSF PR.AA-01: related, not a mapping | |
| IA.L2-3.5.7 | Password Complexity | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.8 | Password Reuse | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.9 | Temporary Passwords | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.10 | Cryptographically-Protected Passwords | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA.L2-3.5.11 | Obscure Feedback | Art.9(4)(c) | Only shares CSF PR.AA-01: related, not a mapping | |
| MA Maintenance · 4 | ||||
| MA.L2-3.7.1 | Perform Maintenance | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF ID.AM-08: related, not a mapping | |
| MA.L2-3.7.2 | System Maintenance Control | Art.9(4)(f) | Only shares CSF PR.PS-02: related, not a mapping | |
| MA.L2-3.7.3 | Equipment Sanitization | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| MA.L2-3.7.4 | Media Inspection | Art.9(4)(f) | Only shares CSF PR.PS-02: related, not a mapping | |
| MP Media Protection · 1 | ||||
| MP.L2-3.8.5 | Media Accountability | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| SC System and Communications Protection · 4 | ||||
| SC.L2-3.13.2 | Security Engineering | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SC.L2-3.13.3 | Role Separation | Art.9(1)Art.10(3)Art.9(4)(c)+5 | Only shares CSF DE.CM-01, DE.CM-03, DE.CM-09, PR.AA-01…: related, not a mapping | |
| SC.L2-3.13.4 | Shared Resource Control | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SC.L2-3.13.7 | Split Tunneling | Art.9(1)Art.9(4)(c)Art.10(1)+3 | Only shares CSF DE.CM-09, PR.AA-05: related, not a mapping | |
| SI System and Information Integrity · 3 | ||||
| SI.L2-3.14.2 | Malicious Code Protection | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI.L2-3.14.4 | Update Malicious Code Protection | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI.L2-3.14.5 | System & File Scanning | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
Mapped (47)
| CMMC | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| AC Access Control · 8 | ||||
| AC.L2-3.1.1 | Authorized Access Control | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| AC.L2-3.1.2 | Transaction & Function Control | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| AC.L2-3.1.5 | Least Privilege | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| AC.L2-3.1.6 | Non-Privileged Account Use | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| AC.L2-3.1.7 | Privileged Functions | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| AC.L2-3.1.13 | Remote Access Confidentiality | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| AC.L2-3.1.19 | Encrypt CUI on Mobile | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| AC.L2-3.1.20 | External Connections | Editorial | Art.28(8)Art.30(2) | Same topic: Cloud Security (editorial pick) |
| AT Awareness and Training · 3 | ||||
| AT.L2-3.2.1 | Role-Based Risk Awareness | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| AT.L2-3.2.2 | Role-Based Training | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| AT.L2-3.2.3 | Insider Threat Awareness | Editorial | Art.5(4)Art.10(3)Art.13(6) | Same topic: Awareness & Training, Insider Threat (editorial pick) |
| AU Audit and Accountability · 5 | ||||
| AU.L2-3.3.1 | System Auditing | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| AU.L2-3.3.2 | User Accountability | Editorial | Art.10(3) | Same topic: Logging & Audit, Insider Threat (editorial pick) |
| AU.L2-3.3.5 | Audit Correlation | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC (editorial pick) |
| AU.L2-3.3.6 | Reduction & Reporting | Editorial | Art.13(2)Art.17(2) | Same topic: Forensics (editorial pick) |
| AU.L2-3.3.7 | Authoritative Time Source | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| CA Security Assessment · 1 | ||||
| CA.L2-3.12.1 | Security Control Assessment | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| CM Configuration Management · 1 | ||||
| CM.L2-3.4.1 | System Baselining | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| IA Identification and Authentication · 1 | ||||
| IA.L2-3.5.3 | Multifactor Authentication | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| IR Incident Response · 3 | ||||
| IR.L2-3.6.1 | Incident Handling | Editorial | Art.11(2)(b)Art.11(2)(c)Art.13(2)+5 | Same topic: Incident Response, Mitigation, Lessons Learned (editorial pick) |
| IR.L2-3.6.2 | Incident Reporting | Editorial | Art.11(2)(e)Art.11(7)Art.14(1)+6 | Same topic: Comms & Restore, Communication (editorial pick) |
| IR.L2-3.6.3 | Incident Response Testing | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| MP Media Protection · 4 | ||||
| MP.L2-3.8.3 | Media Disposal | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| MP.L2-3.8.4 | Media Markings | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| MP.L2-3.8.6 | Portable Storage Encryption | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| MP.L2-3.8.9 | Protect Backups | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| PE Physical Protection · 6 | ||||
| PE.L2-3.10.1 | Limit Physical Access | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE.L2-3.10.2 | Monitor Facility | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE.L2-3.10.3 | Escort Visitors | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE.L2-3.10.4 | Physical Access Logs | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE.L2-3.10.5 | Manage Physical Access | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE.L2-3.10.6 | Alternative Work Sites | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PS Personnel Security · 1 | ||||
| PS.L2-3.9.1 | Screen Individuals | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| RA Risk Assessment · 3 | ||||
| RA.L2-3.11.1 | Risk Assessments | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Same topic: Risk Management (editorial pick) |
| RA.L2-3.11.2 | Vulnerability Scan | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| RA.L2-3.11.3 | Vulnerability Remediation | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| SC System and Communications Protection · 7 | ||||
| SC.L2-3.13.1 | Boundary Protection | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| SC.L2-3.13.5 | Public-Access System Separation | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| SC.L2-3.13.6 | Network Communication by Exception | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| SC.L2-3.13.8 | Data in Transit | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| SC.L2-3.13.10 | Key Management | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| SC.L2-3.13.11 | CUI Encryption | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| SC.L2-3.13.16 | Data at Rest | Editorial | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Same topic: Data Protection, Encryption (editorial pick) |
| SI System and Information Integrity · 4 | ||||
| SI.L2-3.14.1 | Flaw Remediation | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| SI.L2-3.14.3 | Security Alerts & Advisories | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| SI.L2-3.14.6 | Monitor Communications for Attacks | Editorial | Art.9(1)Art.10(1)Art.10(2)+1 | Same topic: Cont. Monitoring, Intrusion Detection (editorial pick) |
| SI.L2-3.14.7 | Identify Unauthorized Use | Editorial | Art.9(1)Art.10(1)Art.10(3) | Same topic: Cont. Monitoring, Anomaly Detection (editorial pick) |
By topic
Both cover (31):
Awareness & TrainingRisk ManagementComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtThreat IntelligenceAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingLessons LearnedComms & RestoreInsider ThreatPhysical Security
Only CMMC (8):
Endpoint ProtectionSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityDLP
Only DORA (8):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.