DORA · Chapter II: ICT risk management
Art.11(2)(e)
Response and recovery
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0RC.CO-03 RC.CO-04 RC.RP-05
topicsComms & Restore
frameworks0 8 2
Official textset out communication and crisis management actions that ensure that updated information is transmitted to all relevant internal staff and external stakeholders in accordance with Article 14, and report to the competent authorities in accordance with Article 19.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RC.CO-03RC.CO-04RC.RP-05 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders; Public updates on incident recovery are shared using approved methods and messaging… | Editorial | Same topic: Comms & Restore (editorial pick) |
| ISO 27001 | A.5.26Clause 7.4 | Response to information security incidents; Communication | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| CIS v8.1 | CIS 17.6 | Define Mechanisms for Communicating During Incident Response | Editorial | Same topic: Comms & Restore (editorial pick) |
| SOC 2 | CC2.3CC7.5 | Communication with external parties; Recovering from identified security incidents | Editorial | Same topic: Comms & Restore (editorial pick) |
| PCI DSS | 12.10.112.10.36.2.310.4.1 | Incident response plan ready to activate; Incident response staff available around the clock… | No mapping. Only shares CSF RC.CO-03, RC.CO-04, RC.RP-05: related, not a mapping | |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| 800-53 | CP-10IR-6 | System Recovery and Reconstitution; Incident Reporting | Editorial | Same topic: Comms & Restore (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C) | Security Incident Procedures; Response and Reporting… | No mapping. Only shares CSF RC.CO-03, RC.CO-04, RC.RP-05: related, not a mapping+9 more loosely related (not mappings)§164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RC.CO-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF RC.CO-04: related, not a mapping …and 5 more in the downloads | |
| GDPR | Art.34(1) | Communication of a personal data breach to the data subject | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| NIS2 | 4.3 | Crisis management | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | No mapping. Only shares CSF RC.RP-05: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.