Comparison
DORA vs CPS 234
DORA (Regulation (EU) 2022/2554) · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of DORA (Regulation (EU) 2022/2554) and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 23 map to something in DORA, 0 are only loosely related, and 1 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to DORA (1)
| CPS 234 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to DORA in our data. |
Mapped (23)
| CPS 234 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | Art.5(2)(a)Art.5(2)(c)Art.5(3)+5 | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| Para 14 | Define information security roles and responsibilities | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| Information security capability · 3 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| Para 16 | Assess third parties' information security capability | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | Art.8(2)Art.8(3)Art.8(7)+5 | Same topic: Risk Assessment, Vulnerability Mgmt, Threat Intelligence (editorial pick) |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| Para 19 | Policies direct everyone with security obligations | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management, Data Classification (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | Art.8(2)Art.8(3)Art.8(7)+3 | Same topic: Risk Assessment (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | Art.10(1)Art.10(2)Art.11(2)(b)+3 | Same topic: Intrusion Detection, Incident Response (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | Art.11(2)(b)Art.13(2)Art.13(3)+6 | Same topic: Incident Response, Lessons Learned (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 4 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+6 | Same topic: Risk Management (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | Art.5(2)(f)Art.6(6)Art.6(7)+6 | Same topic: Compliance (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 20 map to something in CPS 234, 0 are only loosely related, and 2 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to CPS 234 (2)
| DORA | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 2 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | No mapping in our data | — | No mapping to CPS 234 in our data. |
Mapped (20)
| DORA | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 9 | ||||
| Art.5 | Governance and organisation | Editorial | Para 13Para 15Para 27+7 | Same topic: Risk Management (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | Para 13Para 15Para 27+7 | Same topic: Risk Management (editorial pick) |
| Art.8 | Identification | Editorial | Para 20Para 17Para 21+2 | Same topic: Asset Management, Data Classification, Risk Assessment, Vulnerability Mgmt, Threat Intelligence (editorial pick) |
| Art.9 | Protection and prevention | Editorial | Para 21Para 18Para 19 | Same topic: Data Protection, Governance Policy (editorial pick) |
| Art.10 | Detection | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| Art.11 | Response and recovery | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| Art.13 | Learning and evolving | Editorial | Para 17Para 25 | Same topic: Threat Intelligence, Lessons Learned (editorial pick) |
| Art.14 | Communication | Editorial | Para 25 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | Para 23Para 24Para 25+3 | Same topic: Incident Response (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | Para 35Para 36 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | Para 16Para 22Para 28+1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Editorial | Para 17 | Same topic: Threat Intelligence (editorial pick) |
By topic
Both cover (17):
Governance PolicyRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtThreat IntelligenceData ProtectionIntrusion DetectionIncident ResponseCommunicationReportingLessons LearnedVendor Risk Mgmt
Only DORA (22):
Awareness & TrainingBusiness EnvironmentAccess ControlMulti-Factor AuthEncryptionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCForensicsMitigationRecovery PlanningBusiness ContinuityComms & RestoreDisaster RecoveryInsider ThreatPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.