DORA · Chapter II: ICT risk management
Art.10(1)
Detection
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0DE.AE-02 DE.AE-04 DE.CM-01 DE.CM-09
topicsIntrusion Detection, Anomaly Detection
frameworks0 10 1
Official textFinancial entities shall have in place mechanisms to promptly detect anomalous activities, in accordance with Article 17, including ICT network performance issues and ICT-related incidents, and to identify potential material single points of failure. All detection mechanisms referred to in the first subparagraph shall be regularly tested in accordance with Article 25.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-02DE.AE-04DE.CM-01DE.CM-09 | Potentially adverse events are analyzed to better understand associated activities; The estimated impact and scope of adverse events are understood… | Editorial | Same topic: Intrusion Detection, Anomaly Detection (editorial pick) |
| ISO 27001 | A.8.16 | Monitoring activities | Editorial | Same topic: Intrusion Detection, Anomaly Detection (editorial pick) |
| CIS v8.1 | CIS 8.11CIS 13.2CIS 13.3CIS 13.7CIS 13.8 | Conduct Audit Log Reviews; Deploy a Host-Based Intrusion Detection Solution… | Editorial | Same topic: Anomaly Detection, Intrusion Detection (editorial pick)20 loosely related (not mappings)CIS 13.6 Collect Network Traffic Flow Logs Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping CIS 4.9 Configure Trusted DNS Servers on Enterprise Assets Only shares CSF DE.CM-01: related, not a mapping CIS 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients Only shares CSF DE.CM-09: related, not a mapping CIS 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Only shares CSF DE.CM-09: related, not a mapping …and 12 more in the downloads |
| SOC 2 | CC7.2 | Monitoring system components for anomalies | Editorial | Same topic: Intrusion Detection, Anomaly Detection (editorial pick) |
| PCI DSS | 10.4.1.111.5.1 | Automated mechanisms for log review; Intrusion detection or prevention on network traffic | Editorial | Same topic: Anomaly Detection, Intrusion Detection (editorial pick)18 loosely related (not mappings)10.2.1 Audit logs enabled and active Only shares CSF DE.AE-02, DE.AE-04, DE.CM-01: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Only shares CSF DE.AE-02, DE.AE-04, DE.CM-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF DE.AE-04, DE.CM-01: related, not a mapping 5.2.2 Anti-malware detects, removes or contains known malware Only shares CSF DE.CM-09: related, not a mapping 5.3.2 Periodic scans or continuous behavioural analysis Only shares CSF DE.CM-09: related, not a mapping …and 10 more in the downloads |
| CMMC | SI.L2-3.14.6SI.L2-3.14.7 | Monitor Communications for Attacks; Identify Unauthorized Use | Editorial | Same topic: Intrusion Detection, Anomaly Detection (editorial pick)17 loosely related (not mappings)CA.L2-3.12.3 Security Control Monitoring Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping CM.L2-3.4.9 User-Installed Software Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping …and 9 more in the downloads |
| 800-53 | AU-6SI-4 | Audit Record Review, Analysis, and Reporting; System Monitoring | Editorial | Same topic: Anomaly Detection, Intrusion Detection (editorial pick)25 loosely related (not mappings)…and 17 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(D)§164.308(a)(8)§164.308(a)(3)(ii)(A)§164.308(a)(4)(ii)(B) | Information System Activity Review; Evaluation… | No mapping. Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping+15 more loosely related (not mappings)§164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-01: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF DE.CM-01: related, not a mapping …and 11 more in the downloads | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 3.23.4 | Monitoring and logging; Event assessment and classification | Editorial | Same topic: Intrusion Detection, Anomaly Detection (editorial pick)4 loosely related (not mappings)6.9 Protection against malicious and unauthorised software Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping |
| Essential Eight | ISM-1228 | Cyber security events are analysed in a timely manner to identify cyber security incidents | Editorial | Same topic: Anomaly Detection (editorial pick)9 loosely related (not mappings)ISM-0109 Event logs from workstations are analysed in a timely manner to detect cyber security… Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping ISM-1906 Event logs from internet-facing servers are analysed in a timely manner to detect cyber… Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping ISM-1907 Event logs from non-internet-facing servers are analysed in a timely manner to detect… Only shares CSF DE.AE-02, DE.CM-01, DE.CM-09: related, not a mapping ISM-0843 Application control is implemented on workstations Only shares CSF DE.CM-09: related, not a mapping ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF DE.CM-09: related, not a mapping ISM-1490 Application control is implemented on internet-facing servers Only shares CSF DE.CM-09: related, not a mapping ISM-1544 Microsoft’s recommended application blocklist is implemented Only shares CSF DE.CM-09: related, not a mapping ISM-1657 Application control restricts the execution of executables, libraries, scripts… Only shares CSF DE.CM-09: related, not a mapping …and 1 more in the downloads |
| CPS 234 | Para 23 | Detect and respond to incidents in a timely manner | Editorial | Same topic: Intrusion Detection (editorial pick) |
| Cyber Essentials | CE 5 | Malware protection | No mapping. Only shares CSF DE.CM-09: related, not a mapping |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.