Comparison
NIST CSF 2.0 vs DORA
NIST Cybersecurity Framework 2.0 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of NIST Cybersecurity Framework 2.0 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 21 map to something in NIST CSF 2.0, 0 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to NIST CSF 2.0 (1)
| DORA | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to NIST CSF 2.0 in our data. |
Mapped (21)
| DORA | Requirement | Match | NIST CSF 2.0 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 10 | ||||
| Art.5 | Governance and organisation | Editorial | GV.RM-01GV.RM-02GV.RM-03+10 | Same topic: Risk Management (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | GV.RM-01GV.RM-02GV.RM-03+11 | Same topic: Risk Management (editorial pick) |
| Art.8 | Identification | Editorial | GV.OC-01GV.OC-04GV.OC-05+14 | Same topic: Business Environment (editorial pick) |
| Art.9 | Protection and prevention | Editorial | DE.CM-01DE.CM-03DE.CM-09+14 | Same topic: Cont. Monitoring (editorial pick) |
| Art.10 | Detection | Editorial | DE.AE-02DE.AE-04DE.CM-01+7 | Same topic: Intrusion Detection, Anomaly Detection (editorial pick) |
| Art.11 | Response and recovery | Editorial | GV.OC-04PR.IR-03RC.RP-04+14 | Same topic: Business Continuity (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | PR.DS-11RC.RP-03PR.IR-03+4 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | DE.AE-07ID.RA-02ID.RA-03+7 | Same topic: Threat Intelligence (editorial pick) |
| Art.14 | Communication | Editorial | RS.CO-03 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | GV.RM-01GV.RM-02GV.RM-03+1 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | ID.IM-04RS.MA-01RS.MA-02+8 | Same topic: Incident Response (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | ID.IM-04RS.CO-02RS.MA-01+3 | Same topic: Incident Response, Reporting (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | RS.CO-02 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | GV.RM-01GV.RM-02GV.RM-03+1 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | ID.RA-01ID.RA-08 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | GV.SC-01GV.SC-03GV.SC-05+10 | Same topic: Supply Chain Risk (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | GV.SC-01GV.SC-03GV.SC-05+2 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | DE.CM-06GV.SC-04GV.SC-06+5 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | Editorial | DE.AE-07ID.RA-02ID.RA-03 | Same topic: Threat Intelligence (editorial pick) |
Of 106 NIST Cybersecurity Framework 2.0 requirements, 86 map to something in DORA, 0 are only loosely related, and 20 have no mapping in our data.
Likely new work: NIST CSF 2.0 requirements with no mapping to DORA (20)
| NIST CSF 2.0 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Govern (GV) · 9 | ||||
| GV.OC-02 | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | No mapping in our data | — | No mapping to DORA in our data. |
| GV.OV-01 | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | No mapping in our data | — | No mapping to DORA in our data. |
| GV.OV-02 | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | No mapping in our data | — | No mapping to DORA in our data. |
| GV.RM-04 | Strategic direction that describes appropriate risk response options is established and communicated | No mapping in our data | — | No mapping to DORA in our data. |
| GV.RM-05 | Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties | No mapping in our data | — | No mapping to DORA in our data. |
| GV.RM-07 | Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions | No mapping in our data | — | No mapping to DORA in our data. |
| GV.SC-02 | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | No mapping in our data | — | No mapping to DORA in our data. |
| GV.SC-08 | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | No mapping in our data | — | No mapping to DORA in our data. |
| GV.SC-10 | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | No mapping in our data | — | No mapping to DORA in our data. |
| Identify (ID) · 3 | ||||
| ID.IM-01 | Improvements are identified from evaluations | No mapping in our data | — | No mapping to DORA in our data. |
| ID.IM-02 | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | No mapping in our data | — | No mapping to DORA in our data. |
| ID.RA-07 | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | No mapping in our data | — | No mapping to DORA in our data. |
| Protect (PR) · 6 | ||||
| PR.AA-02 | Identities are proofed and bound to credentials based on the context of interactions | No mapping in our data | — | No mapping to DORA in our data. |
| PR.AA-04 | Identity assertions are protected, conveyed, and verified | No mapping in our data | — | No mapping to DORA in our data. |
| PR.IR-04 | Adequate resource capacity to ensure availability is maintained | No mapping in our data | — | No mapping to DORA in our data. |
| PR.PS-03 | Hardware is maintained, replaced, and removed commensurate with risk | No mapping in our data | — | No mapping to DORA in our data. |
| PR.PS-05 | Installation and execution of unauthorized software are prevented | No mapping in our data | — | No mapping to DORA in our data. |
| PR.PS-06 | Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle | No mapping in our data | — | No mapping to DORA in our data. |
| Respond (RS) · 2 | ||||
| RS.AN-08 | An incident's magnitude is estimated and validated | No mapping in our data | — | No mapping to DORA in our data. |
| RS.MA-05 | The criteria for initiating incident recovery are applied | No mapping in our data | — | No mapping to DORA in our data. |
Mapped (86)
| NIST CSF 2.0 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| Detect (DE) · 11 | ||||
| DE.AE-02 | Potentially adverse events are analyzed to better understand associated activities | Editorial | Art.10(1)Art.10(2) | Same topic: Intrusion Detection, Anomaly Detection (editorial pick) |
| DE.AE-03 | Information is correlated from multiple sources | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC, Logging & Audit (editorial pick) |
| DE.AE-04 | The estimated impact and scope of adverse events are understood | Editorial | Art.10(1) | Same topic: Anomaly Detection (editorial pick) |
| DE.AE-06 | Information on adverse events is provided to authorized staff and tools | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC (editorial pick) |
| DE.AE-07 | Cyber threat intelligence and other contextual information are integrated into the analysis | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| DE.AE-08 | Incidents are declared when adverse events meet the defined incident criteria | Editorial | Art.10(2)Art.10(3) | Same topic: SIEM / SOC (editorial pick) |
| DE.CM-01 | Networks and network services are monitored to find potentially adverse events | Editorial | Art.9(1)Art.10(1)Art.10(2)+1 | Same topic: Cont. Monitoring, Intrusion Detection (editorial pick) |
| DE.CM-02 | The physical environment is monitored to find potentially adverse events | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| DE.CM-03 | Personnel activity and technology usage are monitored to find potentially adverse events | Editorial | Art.9(1)Art.10(3) | Same topic: Cont. Monitoring, Insider Threat (editorial pick) |
| DE.CM-06 | External service provider activities and services are monitored to find potentially adverse events | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| DE.CM-09 | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | Editorial | Art.9(1)Art.10(1)Art.10(3) | Same topic: Cont. Monitoring, Anomaly Detection (editorial pick) |
| Govern (GV) · 22 | ||||
| GV.OC-01 | The organizational mission is understood and informs cybersecurity risk management | Editorial | Art.8(1)Art.11(5) | Same topic: Business Environment (editorial pick) |
| GV.OC-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| GV.OC-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | Editorial | Art.8(1)Art.11(1)Art.11(4)+2 | Same topic: Business Environment, Business Continuity (editorial pick) |
| GV.OC-05 | Outcomes, capabilities, and services that the organization depends on are understood and communicated | Editorial | Art.8(1)Art.11(5) | Same topic: Business Environment (editorial pick) |
| GV.OV-03 | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| GV.PO-01 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| GV.PO-02 | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| GV.RM-01 | Risk management objectives are established and agreed to by organizational stakeholders | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| GV.RM-02 | Risk appetite and risk tolerance statements are established, communicated, and maintained | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| GV.RM-03 | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| GV.RM-06 | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| GV.RR-01 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| GV.RR-02 | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| GV.RR-03 | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| GV.RR-04 | Cybersecurity is included in human resources practices | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| GV.SC-01 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| GV.SC-03 | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| GV.SC-04 | Suppliers are known and prioritized by criticality | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| GV.SC-05 | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| GV.SC-06 | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| GV.SC-07 | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| GV.SC-09 | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| Identify (ID) · 18 | ||||
| ID.AM-01 | Inventories of hardware managed by the organization are maintained | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| ID.AM-02 | Inventories of software, services, and systems managed by the organization are maintained | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| ID.AM-03 | Representations of the organization's authorized network communication and internal and external network data flows are maintained | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| ID.AM-04 | Inventories of services provided by suppliers are maintained | Editorial | Art.8(1)Art.8(4)Art.8(6)+2 | Same topic: Asset Management (editorial pick) |
| ID.AM-05 | Assets are prioritized based on classification, criticality, resources, and impact on the mission | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| ID.AM-07 | Inventories of data and corresponding metadata for designated data types are maintained | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| ID.AM-08 | Systems, hardware, software, services, and data are managed throughout their life cycles | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| ID.IM-03 | Improvements are identified from execution of operational processes, procedures, and activities | Editorial | Art.13(2)Art.13(3) | Same topic: Lessons Learned (editorial pick) |
| ID.IM-04 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | Editorial | Art.11(2)(b)Art.11(3)Art.12(6)+3 | Same topic: Incident Response, Recovery Planning (editorial pick) |
| ID.RA-01 | Vulnerabilities in assets are identified, validated, and recorded | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| ID.RA-02 | Cyber threat intelligence is received from information sharing forums and sources | Editorial | Art.8(2)Art.13(1)Art.45(1) | Same topic: Threat Intelligence (editorial pick) |
| ID.RA-03 | Internal and external threats to the organization are identified and recorded | Editorial | Art.8(2)Art.8(3)Art.8(7)+2 | Same topic: Risk Assessment, Threat Intelligence (editorial pick) |
| ID.RA-04 | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| ID.RA-05 | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| ID.RA-06 | Risk responses are chosen, prioritized, planned, tracked, and communicated | Editorial | Art.8(2)Art.8(3)Art.8(7) | Same topic: Risk Assessment (editorial pick) |
| ID.RA-08 | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| ID.RA-09 | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | Editorial | Art.28(2)Art.29(1)Art.29(2) | Same topic: Supply Chain Risk (editorial pick) |
| ID.RA-10 | Critical suppliers are assessed prior to acquisition | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Protect (PR) · 16 | ||||
| PR.AA-01 | Identities and credentials for authorized users, services, and hardware are managed by the organization | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| PR.AA-03 | Users, services, and hardware are authenticated | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| PR.AA-05 | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | Editorial | Art.9(4)(c) | Same topic: Access Control, Privileged Access (editorial pick) |
| PR.AA-06 | Physical access to assets is managed, monitored, and enforced commensurate with risk | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PR.AT-01 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| PR.AT-02 | Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| PR.DS-01 | The confidentiality, integrity, and availability of data-at-rest are protected | Editorial | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Same topic: Data Protection, Encryption (editorial pick) |
| PR.DS-02 | The confidentiality, integrity, and availability of data-in-transit are protected | Editorial | Art.9(2)Art.9(3)(a)Art.9(3)(c)+2 | Same topic: Data Protection, Encryption (editorial pick) |
| PR.DS-10 | The confidentiality, integrity, and availability of data-in-use are protected | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| PR.DS-11 | Backups of data are created, protected, maintained, and tested | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| PR.IR-01 | Networks and environments are protected from unauthorized logical access and usage | Editorial | Art.9(4)(b)Art.28(8)Art.30(2) | Same topic: Firewall / Net Seg, Cloud Security (editorial pick) |
| PR.IR-02 | The organization's technology assets are protected from environmental threats | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| PR.IR-03 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | Editorial | Art.11(1)Art.11(4)Art.11(6)+1 | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| PR.PS-01 | Configuration management practices are established and applied | Editorial | Art.28(8)Art.30(2) | Same topic: Cloud Security (editorial pick) |
| PR.PS-02 | Software is maintained, replaced, and removed commensurate with risk | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| PR.PS-04 | Log records are generated and made available for continuous monitoring | Editorial | Art.10(3) | Same topic: Logging & Audit (editorial pick) |
| Recover (RC) · 8 | ||||
| RC.CO-03 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | Editorial | Art.11(2)(e)Art.11(7) | Same topic: Comms & Restore (editorial pick) |
| RC.CO-04 | Public updates on incident recovery are shared using approved methods and messaging | Editorial | Art.11(2)(e)Art.11(7) | Same topic: Comms & Restore (editorial pick) |
| RC.RP-01 | The recovery portion of the incident response plan is executed once initiated from the incident response process | Editorial | Art.11(3)Art.12(6) | Same topic: Recovery Planning (editorial pick) |
| RC.RP-02 | Recovery actions are selected, scoped, prioritized, and performed | Editorial | Art.11(3)Art.11(6)Art.12(4)+1 | Same topic: Recovery Planning, Disaster Recovery (editorial pick) |
| RC.RP-03 | The integrity of backups and other restoration assets is verified before using them for restoration | Editorial | Art.12(1)Art.12(2)Art.12(3) | Same topic: Backup & Recovery (editorial pick) |
| RC.RP-04 | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | Editorial | Art.11(1)Art.11(4)Art.11(6) | Same topic: Business Continuity (editorial pick) |
| RC.RP-05 | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | Editorial | Art.11(2)(e)Art.11(6)Art.11(7)+1 | Same topic: Comms & Restore, Disaster Recovery (editorial pick) |
| RC.RP-06 | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Editorial | Art.13(2)Art.13(3) | Same topic: Lessons Learned (editorial pick) |
| Respond (RS) · 11 | ||||
| RS.AN-03 | Analysis is performed to establish what has taken place during an incident and the root cause of the incident | Editorial | Art.13(2)Art.17(2) | Same topic: Forensics (editorial pick) |
| RS.AN-06 | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | Editorial | Art.13(2)Art.17(2) | Same topic: Forensics (editorial pick) |
| RS.AN-07 | Incident data and metadata are collected, and their integrity and provenance are preserved | Editorial | Art.13(2)Art.17(2) | Same topic: Forensics (editorial pick) |
| RS.CO-02 | Internal and external stakeholders are notified of incidents | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
| RS.CO-03 | Information is shared with designated internal and external stakeholders | Editorial | Art.14(1)Art.14(2)Art.17(3)(d) | Same topic: Communication (editorial pick) |
| RS.MA-01 | The incident response plan is executed in coordination with relevant third parties once an incident is declared | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| RS.MA-02 | Incident reports are triaged and validated | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| RS.MA-03 | Incidents are categorized and prioritized | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| RS.MA-04 | Incidents are escalated or elevated as needed | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| RS.MI-01 | Incidents are contained | Editorial | Art.11(2)(c)Art.17(3)(f) | Same topic: Mitigation (editorial pick) |
| RS.MI-02 | Incidents are eradicated | Editorial | Art.11(2)(c)Art.17(3)(f) | Same topic: Mitigation (editorial pick) |
By topic
Both cover (39):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentBusiness EnvironmentData ClassificationVulnerability MgmtThreat IntelligenceAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only NIST CSF 2.0 (11):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.