DORA vs Cyber Essentials
DORA (Regulation (EU) 2022/2554) · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of DORA (Regulation (EU) 2022/2554) and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 3 map to something in DORA, 2 are only loosely related, and 0 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Check these: only loosely related (a shared CSF outcome, not a mapping) (2)
| Cyber Essentials | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Technical controls · 2 | ||||
| CE 2 | Secure Configuration | Art.9(4)(c)Art.28(8)Art.30(2) | Only shares CSF PR.AA-05, PR.PS-01: related, not a mapping | |
| CE 5 | Malware protection | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
Mapped (3)
| Cyber Essentials | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Technical controls · 3 | ||||
| CE 1 | Firewalls | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| CE 3 | Security Update Management | Editorial | Art.8(1)Art.8(2)Art.8(4)+5 | Same topic: Asset Management, Vulnerability Mgmt (editorial pick) |
| CE 4 | User Access Control | Editorial | Art.9(4)(c)Art.9(4)(d)Art.28(8)+1 | Same topic: Access Control, Privileged Access, Multi-Factor Auth, Cloud Security (editorial pick) |
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 7 map to something in Cyber Essentials, 1 are only loosely related, and 14 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to Cyber Essentials (14)
| DORA | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 8 | ||||
| Art.5 | Governance and organisation | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.6 | ICT risk management framework | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.11 | Response and recovery | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.13 | Learning and evolving | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.14 | Communication | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.16 | Simplified ICT risk management framework | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.18 | Classification of ICT-related incidents and cyber threats | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Chapter IV: Resilience testing · 1 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Chapter V: ICT third-party risk · 1 | ||||
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| DORA | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.10 | Detection | CE 5 | Only shares CSF DE.CM-09: related, not a mapping | |
Mapped (7)
| DORA | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 2 | ||||
| Art.8 | Identification | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| Art.9 | Protection and prevention | Editorial | CE 1CE 3 | Same topic: Firewall / Net Seg, Patch Management (editorial pick) |
| Chapter IV: Resilience testing · 3 | ||||
| Art.25 | Testing of ICT tools and systems | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 2 | ||||
| Art.28 | General principles | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | CE 4 | Same topic: Cloud Security (editorial pick) |
By topic
Both cover (8):
Only DORA (31):
Only Cyber Essentials (3):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.