Comparison
800-53 vs DORA
NIST SP 800-53 Rev 5.2 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of NIST SP 800-53 Rev 5.2 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 21 map to something in 800-53, 0 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to 800-53 (1)
| DORA | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to 800-53 in our data. |
Mapped (21)
| DORA | Requirement | Match | 800-53 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 10 | ||||
| Art.5 | Governance and organisation | Editorial | PM-9PM-28RA-7+10 | Same topic: Risk Management (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | PM-9PM-28RA-7+14 | Same topic: Risk Management (editorial pick) |
| Art.8 | Identification | Editorial | CM-8PM-5PM-11+7 | Same topic: Asset Management, Business Environment (editorial pick) |
| Art.9 | Protection and prevention | Editorial | CA-7SI-4SC-8+14 | Same topic: Cont. Monitoring, Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | AU-6SI-4AU-6(3)+7 | Same topic: Anomaly Detection, Intrusion Detection, SIEM / SOC (editorial pick) |
| Art.11 | Response and recovery | Editorial | CP-2(8)CP-7IR-2+3 | Same topic: Business Continuity, Incident Response (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | CP-6CP-9CP-7+1 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | PM-15PM-16SI-5+5 | Same topic: Threat Intelligence (editorial pick) |
| Art.14 | Communication | Editorial | IR-7 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | PM-9PM-28RA-7 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | IR-2IR-3IR-4+3 | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | IR-2IR-3IR-4+2 | Same topic: Incident Response (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | IR-6 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | PM-9PM-28RA-7 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | CA-8RA-5 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | PM-30SR-2SR-3+2 | Same topic: Supply Chain Risk (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | PM-30SR-2SR-3+1 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | AC-20SA-4SA-9+1 | Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Editorial | PM-15PM-16SI-5 | Same topic: Threat Intelligence (editorial pick) |
Of 300 NIST SP 800-53 Rev 5.2 requirements, 70 map to something in DORA, 123 are only loosely related, and 107 have no mapping in our data.
Likely new work: 800-53 requirements with no mapping to DORA (107)
| 800-53 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| AC Access Control · 6 | ||||
| AC-8 | System Use Notification | No mapping in our data | — | No mapping to DORA in our data. |
| AC-11 | Device Lock | No mapping in our data | — | No mapping to DORA in our data. |
| AC-21 | Information Sharing | No mapping in our data | — | No mapping to DORA in our data. |
| AC-22 | Publicly Accessible Content | No mapping in our data | — | No mapping to DORA in our data. |
| AC-23 | Data Mining Protection | No mapping in our data | — | No mapping to DORA in our data. |
| AC-25 | Reference Monitor | No mapping in our data | — | No mapping to DORA in our data. |
| AT Awareness and Training · 2 | ||||
| AT-4 | Training Records | No mapping in our data | — | No mapping to DORA in our data. |
| AT-6 | Training Feedback | No mapping in our data | — | No mapping to DORA in our data. |
| AU Audit and Accountability · 5 | ||||
| AU-4 | Audit Log Storage Capacity | No mapping in our data | — | No mapping to DORA in our data. |
| AU-5 | Response to Audit Logging Process Failures | No mapping in our data | — | No mapping to DORA in our data. |
| AU-8 | Time Stamps | No mapping in our data | — | No mapping to DORA in our data. |
| AU-10 | Non-repudiation | No mapping in our data | — | No mapping to DORA in our data. |
| AU-14 | Session Audit | No mapping in our data | — | No mapping to DORA in our data. |
| CA Assessment, Authorization and Monitoring · 2 | ||||
| CA-5 | Plan of Action and Milestones | No mapping in our data | — | No mapping to DORA in our data. |
| CA-6 | Authorization | No mapping in our data | — | No mapping to DORA in our data. |
| CM Configuration Management · 1 | ||||
| CM-14 | Signed Components | No mapping in our data | — | No mapping to DORA in our data. |
| CP Contingency Planning · 5 | ||||
| CP-3 | Contingency Training | No mapping in our data | — | No mapping to DORA in our data. |
| CP-8 | Telecommunications Services | No mapping in our data | — | No mapping to DORA in our data. |
| CP-11 | Alternate Communications Protocols | No mapping in our data | — | No mapping to DORA in our data. |
| CP-12 | Safe Mode | No mapping in our data | — | No mapping to DORA in our data. |
| CP-13 | Alternative Security Mechanisms | No mapping in our data | — | No mapping to DORA in our data. |
| IA Identification and Authentication · 1 | ||||
| IA-12 | Identity Proofing | No mapping in our data | — | No mapping to DORA in our data. |
| IR Incident Response · 1 | ||||
| IR-9 | Information Spillage Response | No mapping in our data | — | No mapping to DORA in our data. |
| MA Maintenance · 3 | ||||
| MA-4 | Nonlocal Maintenance | No mapping in our data | — | No mapping to DORA in our data. |
| MA-5 | Maintenance Personnel | No mapping in our data | — | No mapping to DORA in our data. |
| MA-7 | Field Maintenance | No mapping in our data | — | No mapping to DORA in our data. |
| MP Media Protection · 6 | ||||
| MP-2 | Media Access | No mapping in our data | — | No mapping to DORA in our data. |
| MP-3 | Media Marking | No mapping in our data | — | No mapping to DORA in our data. |
| MP-4 | Media Storage | No mapping in our data | — | No mapping to DORA in our data. |
| MP-5 | Media Transport | No mapping in our data | — | No mapping to DORA in our data. |
| MP-6 | Media Sanitization | No mapping in our data | — | No mapping to DORA in our data. |
| MP-7 | Media Use | No mapping in our data | — | No mapping to DORA in our data. |
| PE Physical and Environmental Protection · 4 | ||||
| PE-16 | Delivery and Removal | No mapping in our data | — | No mapping to DORA in our data. |
| PE-17 | Alternate Work Site | No mapping in our data | — | No mapping to DORA in our data. |
| PE-21 | Electromagnetic Pulse Protection | No mapping in our data | — | No mapping to DORA in our data. |
| PE-22 | Component Marking | No mapping in our data | — | No mapping to DORA in our data. |
| PL Planning · 5 | ||||
| PL-4 | Rules of Behavior | No mapping in our data | — | No mapping to DORA in our data. |
| PL-7 | Concept of Operations | No mapping in our data | — | No mapping to DORA in our data. |
| PL-9 | Central Management | No mapping in our data | — | No mapping to DORA in our data. |
| PL-10 | Baseline Selection | No mapping in our data | — | No mapping to DORA in our data. |
| PL-11 | Baseline Tailoring | No mapping in our data | — | No mapping to DORA in our data. |
| PM Program Management · 9 | ||||
| PM-10 | Authorization Process | No mapping in our data | — | No mapping to DORA in our data. |
| PM-14 | Testing, Training, and Monitoring | No mapping in our data | — | No mapping to DORA in our data. |
| PM-17 | Protecting Controlled Unclassified Information on External Systems | No mapping in our data | — | No mapping to DORA in our data. |
| PM-20 | Dissemination of Privacy Program Information | No mapping in our data | — | No mapping to DORA in our data. |
| PM-21 | Accounting of Disclosures | No mapping in our data | — | No mapping to DORA in our data. |
| PM-25 | Minimization of Personally Identifiable Information Used in Testing, Training, and Research | No mapping in our data | — | No mapping to DORA in our data. |
| PM-26 | Complaint Management | No mapping in our data | — | No mapping to DORA in our data. |
| PM-27 | Privacy Reporting | No mapping in our data | — | No mapping to DORA in our data. |
| PM-32 | Purposing | No mapping in our data | — | No mapping to DORA in our data. |
| PS Personnel Security · 6 | ||||
| PS-2 | Position Risk Designation | No mapping in our data | — | No mapping to DORA in our data. |
| PS-3 | Personnel Screening | No mapping in our data | — | No mapping to DORA in our data. |
| PS-4 | Personnel Termination | No mapping in our data | — | No mapping to DORA in our data. |
| PS-5 | Personnel Transfer | No mapping in our data | — | No mapping to DORA in our data. |
| PS-6 | Access Agreements | No mapping in our data | — | No mapping to DORA in our data. |
| PS-8 | Personnel Sanctions | No mapping in our data | — | No mapping to DORA in our data. |
| PT PII Processing and Transparency · 7 | ||||
| PT-2 | Authority to Process Personally Identifiable Information | No mapping in our data | — | No mapping to DORA in our data. |
| PT-3 | Personally Identifiable Information Processing Purposes | No mapping in our data | — | No mapping to DORA in our data. |
| PT-4 | Consent | No mapping in our data | — | No mapping to DORA in our data. |
| PT-5 | Privacy Notice | No mapping in our data | — | No mapping to DORA in our data. |
| PT-6 | System of Records Notice | No mapping in our data | — | No mapping to DORA in our data. |
| PT-7 | Specific Categories of Personally Identifiable Information | No mapping in our data | — | No mapping to DORA in our data. |
| PT-8 | Computer Matching Requirements | No mapping in our data | — | No mapping to DORA in our data. |
| RA Risk Assessment · 1 | ||||
| RA-6 | Technical Surveillance Countermeasures Survey | No mapping in our data | — | No mapping to DORA in our data. |
| SA System and Services Acquisition · 5 | ||||
| SA-2 | Allocation of Resources | No mapping in our data | — | No mapping to DORA in our data. |
| SA-16 | Developer-provided Training | No mapping in our data | — | No mapping to DORA in our data. |
| SA-20 | Customized Development of Critical Components | No mapping in our data | — | No mapping to DORA in our data. |
| SA-21 | Developer Screening | No mapping in our data | — | No mapping to DORA in our data. |
| SA-23 | Specialization | No mapping in our data | — | No mapping to DORA in our data. |
| SC System and Communications Protection · 25 | ||||
| SC-2 | Separation of System and User Functionality | No mapping in our data | — | No mapping to DORA in our data. |
| SC-3 | Security Function Isolation | No mapping in our data | — | No mapping to DORA in our data. |
| SC-10 | Network Disconnect | No mapping in our data | — | No mapping to DORA in our data. |
| SC-15 | Collaborative Computing Devices and Applications | No mapping in our data | — | No mapping to DORA in our data. |
| SC-17 | Public Key Infrastructure Certificates | No mapping in our data | — | No mapping to DORA in our data. |
| SC-18 | Mobile Code | No mapping in our data | — | No mapping to DORA in our data. |
| SC-23 | Session Authenticity | No mapping in our data | — | No mapping to DORA in our data. |
| SC-25 | Thin Nodes | No mapping in our data | — | No mapping to DORA in our data. |
| SC-26 | Decoys | No mapping in our data | — | No mapping to DORA in our data. |
| SC-27 | Platform-independent Applications | No mapping in our data | — | No mapping to DORA in our data. |
| SC-29 | Heterogeneity | No mapping in our data | — | No mapping to DORA in our data. |
| SC-30 | Concealment and Misdirection | No mapping in our data | — | No mapping to DORA in our data. |
| SC-31 | Covert Channel Analysis | No mapping in our data | — | No mapping to DORA in our data. |
| SC-37 | Out-of-band Channels | No mapping in our data | — | No mapping to DORA in our data. |
| SC-38 | Operations Security | No mapping in our data | — | No mapping to DORA in our data. |
| SC-41 | Port and I/O Device Access | No mapping in our data | — | No mapping to DORA in our data. |
| SC-42 | Sensor Capability and Data | No mapping in our data | — | No mapping to DORA in our data. |
| SC-44 | Detonation Chambers | No mapping in our data | — | No mapping to DORA in our data. |
| SC-45 | System Time Synchronization | No mapping in our data | — | No mapping to DORA in our data. |
| SC-46 | Cross Domain Policy Enforcement | No mapping in our data | — | No mapping to DORA in our data. |
| SC-47 | Alternate Communications Paths | No mapping in our data | — | No mapping to DORA in our data. |
| SC-48 | Sensor Relocation | No mapping in our data | — | No mapping to DORA in our data. |
| SC-49 | Hardware-enforced Separation and Policy Enforcement | No mapping in our data | — | No mapping to DORA in our data. |
| SC-50 | Software-enforced Separation and Policy Enforcement | No mapping in our data | — | No mapping to DORA in our data. |
| SC-51 | Hardware-based Protection | No mapping in our data | — | No mapping to DORA in our data. |
| SI System and Information Integrity · 10 | ||||
| SI-6 | Security and Privacy Function Verification | No mapping in our data | — | No mapping to DORA in our data. |
| SI-11 | Error Handling | No mapping in our data | — | No mapping to DORA in our data. |
| SI-14 | Non-persistence | No mapping in our data | — | No mapping to DORA in our data. |
| SI-15 | Information Output Filtering | No mapping in our data | — | No mapping to DORA in our data. |
| SI-17 | Fail-safe Procedures | No mapping in our data | — | No mapping to DORA in our data. |
| SI-19 | De-identification | No mapping in our data | — | No mapping to DORA in our data. |
| SI-20 | Tainting | No mapping in our data | — | No mapping to DORA in our data. |
| SI-21 | Information Refresh | No mapping in our data | — | No mapping to DORA in our data. |
| SI-22 | Information Diversity | No mapping in our data | — | No mapping to DORA in our data. |
| SI-23 | Information Fragmentation | No mapping in our data | — | No mapping to DORA in our data. |
| SR Supply Chain Risk Management · 3 | ||||
| SR-4 | Provenance | No mapping in our data | — | No mapping to DORA in our data. |
| SR-7 | Supply Chain Operations Security | No mapping in our data | — | No mapping to DORA in our data. |
| SR-9 | Tamper Resistance and Detection | No mapping in our data | — | No mapping to DORA in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (123)
| 800-53 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| AC Access Control · 13 | ||||
| AC-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| AC-5 | Separation of Duties | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-6 | Least Privilege | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-7 | Unsuccessful Logon Attempts | Art.9(4)(d) | Only shares CSF PR.AA-03: related, not a mapping | |
| AC-9 | Previous Logon Notification | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| AC-10 | Concurrent Session Control | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-12 | Session Termination | Art.9(4)(d) | Only shares CSF PR.AA-03: related, not a mapping | |
| AC-14 | Permitted Actions Without Identification or Authentication | Art.9(4)(c) | Only shares CSF PR.AA-01: related, not a mapping | |
| AC-16 | Security and Privacy Attributes | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-17 | Remote Access | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-18 | Wireless Access | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-19 | Access Control for Mobile Devices | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AC-24 | Access Control Decisions | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| AT Awareness and Training · 1 | ||||
| AT-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| AU Audit and Accountability · 3 | ||||
| AU-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| AU-9 | Protection of Audit Information | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Only shares CSF PR.DS-10: related, not a mapping | |
| AU-16 | Cross-organizational Audit Logging | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-02: related, not a mapping | |
| CA Assessment, Authorization and Monitoring · 3 | ||||
| CA-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| CA-3 | Information Exchange | Art.9(2)Art.9(3)(c)Art.9(3)(d)+3 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| CA-9 | Internal System Connections | Art.9(4)(b) | Only shares CSF ID.AM-03: related, not a mapping | |
| CM Configuration Management · 12 | ||||
| CM-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| CM-2 | Baseline Configuration | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-3 | Configuration Change Control | Art.9(1)Art.10(1)Art.10(3)+3 | Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping | |
| CM-4 | Impact Analyses | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-5 | Access Restrictions for Change | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-6 | Configuration Settings | Art.9(1)Art.10(1)Art.10(3)+2 | Only shares CSF DE.CM-09: related, not a mapping | |
| CM-7 | Least Functionality | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| CM-9 | Configuration Management Plan | Art.8(1)Art.8(4)Art.8(6)+2 | Only shares CSF ID.AM-08: related, not a mapping | |
| CM-10 | Software Usage Restrictions | Art.9(1)Art.10(3)Art.10(1)+2 | Only shares CSF DE.CM-03, DE.CM-09: related, not a mapping | |
| CM-11 | User-installed Software | Art.9(1)Art.10(3)Art.9(4)(f)+3 | Only shares CSF DE.CM-03, DE.CM-09, PR.PS-02: related, not a mapping | |
| CM-12 | Information Location | Art.8(1) | Only shares CSF ID.AM-07: related, not a mapping | |
| CM-13 | Data Action Mapping | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| CP Contingency Planning · 2 | ||||
| CP-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| CP-4 | Contingency Plan Testing | Art.12(1)Art.12(2)Art.12(3) | Only shares CSF RC.RP-03: related, not a mapping | |
| IA Identification and Authentication · 12 | ||||
| IA-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| IA-2 | Identification and Authentication (Organizational Users) | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-3 | Device Identification and Authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-4 | Identifier Management | Art.9(4)(c) | Only shares CSF PR.AA-01: related, not a mapping | |
| IA-5 | Authenticator Management | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-6 | Authentication Feedback | Art.9(4)(c) | Only shares CSF PR.AA-01: related, not a mapping | |
| IA-7 | Cryptographic Module Authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-8 | Identification and Authentication (Non-organizational Users) | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-9 | Service Identification and Authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-10 | Adaptive Authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-11 | Re-authentication | Art.9(4)(c)Art.9(4)(d) | Only shares CSF PR.AA-01, PR.AA-03: related, not a mapping | |
| IA-13 | Identity Providers and Authorization Servers | Art.9(4)(c) | Only shares CSF PR.AA-05: related, not a mapping | |
| IR Incident Response · 1 | ||||
| IR-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| MA Maintenance · 4 | ||||
| MA-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| MA-2 | Controlled Maintenance | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| MA-3 | Maintenance Tools | Art.9(4)(f) | Only shares CSF PR.PS-02: related, not a mapping | |
| MA-6 | Timely Maintenance | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| MP Media Protection · 2 | ||||
| MP-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| MP-8 | Media Downgrading | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-01: related, not a mapping | |
| PE Physical and Environmental Protection · 12 | ||||
| PE-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| PE-4 | Access Control for Transmission | Art.6(2)Art.9(4)(c) | Only shares CSF PR.AA-06: related, not a mapping | |
| PE-5 | Access Control for Output Devices | Art.6(2)Art.9(4)(c) | Only shares CSF PR.AA-06: related, not a mapping | |
| PE-9 | Power Equipment and Cabling | Art.6(2)Art.9(4)(c) | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-10 | Emergency Shutoff | Art.6(2)Art.9(4)(c) | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-11 | Emergency Power | Art.6(2)Art.9(4)(c) | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-12 | Emergency Lighting | Art.6(2)Art.9(4)(c) | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-15 | Water Damage Protection | Art.6(2)Art.9(4)(c) | Only shares CSF PR.IR-02: related, not a mapping | |
| PE-18 | Location of System Components | Art.6(2)Art.9(4)(c) | Only shares CSF PR.AA-06, PR.IR-02: related, not a mapping | |
| PE-19 | Information Leakage | Art.6(2)Art.9(4)(c) | Only shares CSF PR.AA-06: related, not a mapping | |
| PE-20 | Asset Monitoring and Tracking | Art.6(2)Art.9(4)(c) | Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping | |
| PE-23 | Facility Location | Art.6(2)Art.9(4)(c) | Only shares CSF PR.IR-02: related, not a mapping | |
| PL Planning · 2 | ||||
| PL-2 | System Security and Privacy Plans | Art.8(1)Art.8(4)Art.8(6)+1 | Only shares CSF ID.AM-08: related, not a mapping | |
| PL-8 | Security and Privacy Architectures | Art.9(4)(b) | Only shares CSF ID.AM-03: related, not a mapping | |
| PM Program Management · 10 | ||||
| PM-3 | Information Security and Privacy Resources | Art.5(2)(a)Art.5(2)(c)Art.5(3)+5 | Only shares CSF GV.RM-03, GV.RR-03: related, not a mapping | |
| PM-7 | Enterprise Architecture | Art.9(4)(b) | Only shares CSF ID.AM-03: related, not a mapping | |
| PM-8 | Critical Infrastructure Plan | Art.11(1)Art.11(4)Art.11(6)+2 | Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping | |
| PM-13 | Security and Privacy Workforce | Art.5(2)(c)Art.5(3)Art.6(4)+1 | Only shares CSF GV.RR-02: related, not a mapping | |
| PM-18 | Privacy Program Plan | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Only shares CSF GV.RM-06: related, not a mapping | |
| PM-19 | Privacy Program Leadership Role | Art.5(2)(c)Art.5(3)Art.6(4)+3 | Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| PM-22 | Personally Identifiable Information Quality Management | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| PM-23 | Data Governance Body | Art.5(2)(c)Art.5(3)Art.6(4)+3 | Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| PM-24 | Data Integrity Board | Art.5(2)(c)Art.5(3)Art.6(4) | Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| PM-31 | Continuous Monitoring Strategy | Art.28(2)Art.29(1)Art.29(2) | Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping | |
| PS Personnel Security · 2 | ||||
| PS-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| PS-7 | External Personnel Security | Art.10(3)Art.28(3)Art.28(4)+4 | Only shares CSF GV.RR-04, DE.CM-06: related, not a mapping | |
| PT PII Processing and Transparency · 1 | ||||
| PT-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| RA Risk Assessment · 3 | ||||
| RA-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| RA-8 | Privacy Impact Assessments | Art.8(2)Art.8(3)Art.8(7) | Only shares CSF ID.RA-04: related, not a mapping | |
| RA-10 | Threat Hunting | Art.8(2)Art.10(2)Art.10(3)+2 | Only shares CSF DE.AE-07, DE.AE-06: related, not a mapping | |
| SA System and Services Acquisition · 10 | ||||
| SA-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| SA-3 | System Development Life Cycle | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-5 | System Documentation | Art.8(1)Art.8(4)Art.8(6)+3 | Only shares CSF ID.AM-02: related, not a mapping | |
| SA-8 | Security and Privacy Engineering Principles | Art.8(1)Art.8(4)Art.8(6)+5 | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-10 | Developer Configuration Management | Art.9(4)(f)Art.28(2)Art.29(1)+1 | Only shares CSF PR.PS-02, ID.RA-09: related, not a mapping | |
| SA-11 | Developer Testing and Evaluation | Art.8(2)Art.25(1)Art.26(1)+4 | Only shares CSF ID.RA-01: related, not a mapping | |
| SA-15 | Development Process, Standards, and Tools | Art.8(2)Art.10(3)Art.25(1)+5 | Only shares CSF ID.RA-01, PR.PS-04: related, not a mapping | |
| SA-17 | Developer Security and Privacy Architecture and Design | Art.28(2)Art.29(1)Art.29(2) | Only shares CSF ID.RA-09: related, not a mapping | |
| SA-22 | Unsupported System Components | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| SA-24 | Design For Cyber Resiliency | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Only shares CSF GV.RM-03: related, not a mapping | |
| SC System and Communications Protection · 17 | ||||
| SC-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| SC-4 | Information in Shared System Resources | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SC-5 | Denial-of-service Protection | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-6 | Resource Availability | Art.11(1)Art.11(4)Art.11(6)+1 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-11 | Trusted Path | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-02, PR.DS-10: related, not a mapping | |
| SC-16 | Transmission of Security and Privacy Attributes | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Only shares CSF PR.DS-02: related, not a mapping | |
| SC-20 | Secure Name/Address Resolution Service (Authoritative Source) | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-21 | Secure Name/Address Resolution Service (Recursive or Caching Resolver) | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-22 | Architecture and Provisioning for Name/Address Resolution Service | Art.9(1)Art.9(4)(b)Art.10(1)+4 | Only shares CSF DE.CM-01, PR.IR-01: related, not a mapping | |
| SC-24 | Fail in Known State | Art.9(2)Art.9(3)(c)Art.9(3)(d)+4 | Only shares CSF PR.DS-10: related, not a mapping | |
| SC-32 | System Partitioning | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| SC-34 | Non-modifiable Executable Programs | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| SC-35 | External Malicious Code Identification | Art.9(1)Art.10(1)Art.10(3) | Only shares CSF DE.CM-09: related, not a mapping | |
| SC-36 | Distributed Processing and Storage | Art.11(1)Art.11(4)Art.11(6)+1 | Only shares CSF PR.IR-03: related, not a mapping | |
| SC-39 | Process Isolation | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-10: related, not a mapping | |
| SC-40 | Wireless Link Protection | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-02, PR.DS-10: related, not a mapping | |
| SC-43 | Usage Restrictions | Art.9(2)Art.9(3)(c)Art.9(3)(d)+2 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI System and Information Integrity · 8 | ||||
| SI-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| SI-3 | Malicious Code Protection | Art.9(2)Art.9(3)(c)Art.9(3)(d)+5 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| SI-8 | Spam Protection | Art.9(1)Art.9(2)Art.9(3)(a)+5 | Only shares CSF DE.CM-09, PR.DS-02: related, not a mapping | |
| SI-10 | Information Input Validation | Art.9(2)Art.9(3)(c)Art.9(3)(d)+4 | Only shares CSF PR.DS-10: related, not a mapping | |
| SI-12 | Information Management and Retention | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping | |
| SI-13 | Predictable Failure Prevention | Art.11(1)Art.11(4)Art.11(6)+1 | Only shares CSF PR.IR-03: related, not a mapping | |
| SI-16 | Memory Protection | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Only shares CSF PR.DS-10: related, not a mapping | |
| SI-18 | Personally Identifiable Information Quality Operations | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| SR Supply Chain Risk Management · 5 | ||||
| SR-1 | Policy and Procedures | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping | |
| SR-5 | Acquisition Strategies, Tools, and Methods | Art.28(2)Art.29(1)Art.29(2)+5 | Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping | |
| SR-8 | Notification Agreements | Art.18(1)Art.11(2)(b)Art.11(2)(e)+5 | Only shares CSF RS.CO-02, RS.MA-01, RC.CO-03: related, not a mapping | |
| SR-10 | Inspection of Systems or Components | Art.28(2)Art.29(1)Art.29(2) | Only shares CSF GV.SC-05, ID.RA-09: related, not a mapping | |
| SR-12 | Component Disposal | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
Mapped (70)
| 800-53 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| AC Access Control · 4 | ||||
| AC-2 | Account Management | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| AC-3 | Access Enforcement | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| AC-4 | Information Flow Enforcement | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| AC-20 | Use of External Systems | Editorial | Art.28(8)Art.30(2) | Same topic: Cloud Security (editorial pick) |
| AT Awareness and Training · 2 | ||||
| AT-2 | Literacy Training and Awareness | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| AT-3 | Role-based Training | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| AU Audit and Accountability · 7 | ||||
| AU-2 | Event Logging | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| AU-3 | Content of Audit Records | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| AU-6 | Audit Record Review, Analysis, and Reporting | Editorial | Art.10(1)Art.10(2)Art.10(3) | Same topic: Anomaly Detection, SIEM / SOC (editorial pick) |
| AU-7 | Audit Record Reduction and Report Generation | Editorial | Art.13(2)Art.17(2) | Same topic: Forensics (editorial pick) |
| AU-11 | Audit Record Retention | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| AU-12 | Audit Record Generation | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| AU-13 | Monitoring for Information Disclosure | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| CA Assessment, Authorization and Monitoring · 3 | ||||
| CA-2 | Control Assessments | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| CA-7 | Continuous Monitoring | Editorial | Art.9(1)Art.10(3) | Same topic: Cont. Monitoring (editorial pick) |
| CA-8 | Penetration Testing | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| CM Configuration Management · 1 | ||||
| CM-8 | System Component Inventory | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| CP Contingency Planning · 5 | ||||
| CP-2 | Contingency Plan | Editorial | Art.11(3)Art.12(6) | Same topic: Recovery Planning (editorial pick) |
| CP-6 | Alternate Storage Site | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| CP-7 | Alternate Processing Site | Editorial | Art.11(1)Art.11(4)Art.11(6)+1 | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| CP-9 | System Backup | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| CP-10 | System Recovery and Reconstitution | Editorial | Art.11(2)(e)Art.11(3)Art.11(6)+3 | Same topic: Comms & Restore, Recovery Planning, Disaster Recovery (editorial pick) |
| IR Incident Response · 7 | ||||
| IR-2 | Incident Response Training | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| IR-3 | Incident Response Testing | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| IR-4 | Incident Handling | Editorial | Art.11(2)(b)Art.11(2)(c)Art.13(2)+5 | Same topic: Incident Response, Mitigation, Lessons Learned (editorial pick) |
| IR-5 | Incident Monitoring | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC (editorial pick) |
| IR-6 | Incident Reporting | Editorial | Art.11(2)(e)Art.11(7)Art.18(1)+3 | Same topic: Comms & Restore, Reporting (editorial pick) |
| IR-7 | Incident Response Assistance | Editorial | Art.14(1)Art.14(2)Art.17(3)(d) | Same topic: Communication (editorial pick) |
| IR-8 | Incident Response Plan | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| PE Physical and Environmental Protection · 6 | ||||
| PE-2 | Physical Access Authorizations | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE-3 | Physical Access Control | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE-6 | Monitoring Physical Access | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE-8 | Visitor Access Records | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE-13 | Fire Protection | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PE-14 | Environmental Controls | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PL Planning · 1 | ||||
| PL-1 | Policy and Procedures | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| PM Program Management · 13 | ||||
| PM-1 | Information Security Program Plan | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| PM-2 | Information Security Program Leadership Role | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| PM-4 | Plan of Action and Milestones Process | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| PM-5 | System Inventory | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| PM-6 | Measures of Performance | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| PM-9 | Risk Management Strategy | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| PM-11 | Mission and Business Process Definition | Editorial | Art.8(1)Art.11(5) | Same topic: Business Environment (editorial pick) |
| PM-12 | Insider Threat Program | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| PM-15 | Security and Privacy Groups and Associations | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| PM-16 | Threat Awareness Program | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| PM-28 | Risk Framing | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| PM-29 | Risk Management Program Leadership Roles | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| PM-30 | Supply Chain Risk Management Strategy | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| PS Personnel Security · 1 | ||||
| PS-9 | Position Descriptions | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| RA Risk Assessment · 5 | ||||
| RA-2 | Security Categorization | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| RA-3 | Risk Assessment | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| RA-5 | Vulnerability Monitoring and Scanning | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| RA-7 | Risk Response | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Same topic: Risk Management (editorial pick) |
| RA-9 | Criticality Analysis | Editorial | Art.8(1)Art.11(5) | Same topic: Business Environment (editorial pick) |
| SA System and Services Acquisition · 2 | ||||
| SA-4 | Acquisition Process | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| SA-9 | External System Services | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| SC System and Communications Protection · 5 | ||||
| SC-7 | Boundary Protection | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| SC-8 | Transmission Confidentiality and Integrity | Editorial | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Same topic: Data Protection, Encryption (editorial pick) |
| SC-12 | Cryptographic Key Establishment and Management | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| SC-13 | Cryptographic Protection | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| SC-28 | Protection of Information at Rest | Editorial | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Same topic: Data Protection, Encryption (editorial pick) |
| SI System and Information Integrity · 4 | ||||
| SI-2 | Flaw Remediation | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| SI-4 | System Monitoring | Editorial | Art.9(1)Art.10(1)Art.10(2)+1 | Same topic: Cont. Monitoring, Intrusion Detection, Anomaly Detection (editorial pick) |
| SI-5 | Security Alerts, Advisories, and Directives | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| SI-7 | Software, Firmware, and Information Integrity | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| SR Supply Chain Risk Management · 4 | ||||
| SR-2 | Supply Chain Risk Management Plan | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| SR-3 | Supply Chain Controls and Processes | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| SR-6 | Supplier Assessments and Reviews | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| SR-11 | Component Authenticity | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
By topic
Both cover (39):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentBusiness EnvironmentData ClassificationVulnerability MgmtThreat IntelligenceAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only 800-53 (11):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.