DORA · Chapter II: ICT risk management
Art.11(3)
Response and recovery
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0ID.IM-04 RC.RP-01 RC.RP-02
topicsRecovery Planning
frameworks0 9 2
Official textAs part of the ICT risk management framework referred to in Article 6(1), financial entities shall implement associated ICT response and recovery plans which, in the case of financial entities other than microenterprises, shall be subject to independent internal audit reviews.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-04RC.RP-01RC.RP-02 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; The recovery portion of the incident response plan is executed once initiated from the incident response process… | Editorial | Same topic: Recovery Planning (editorial pick) |
| ISO 27001 | A.5.29A.5.30 | Information security during disruption; ICT readiness for business continuity | Editorial | Same topic: Recovery Planning (editorial pick)1 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Same topic: Recovery Planning (editorial pick) |
| SOC 2 | A1.3CC7.5 | Testing recovery plan procedures; Recovering from identified security incidents | Editorial | Same topic: Recovery Planning (editorial pick)1 loosely related (not mappings)A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF RC.RP-02: related, not a mapping |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Recovery Planning (editorial pick)5 loosely related (not mappings)12.10.2 Incident response plan reviewed and tested annually Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping 12.10.3 Incident response staff available around the clock Only shares CSF ID.IM-04, RC.RP-01: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF ID.IM-04, RC.RP-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-02: related, not a mapping |
| CMMC | IR.L2-3.6.1 | Incident Handling | No mapping. Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping | |
| 800-53 | CP-2CP-10 | Contingency Plan; System Recovery and Reconstitution | Editorial | Same topic: Recovery Planning (editorial pick) |
| HIPAA | §164.308(a)(7)§164.308(a)(7)(ii)(B) | Contingency Plan; Disaster Recovery Plan | Editorial | Same topic: Recovery Planning (editorial pick)4 loosely related (not mappings)§164.308(a)(6)(ii) Response and Reporting Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF ID.IM-04, RC.RP-02: related, not a mapping |
| GDPR | Art.32(1)(c) | Security of processing | Editorial | Same topic: Recovery Planning (editorial pick) |
| NIS2 | 4.1 | Business continuity and disaster recovery plan | Editorial | Same topic: Recovery Planning (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | No mapping. Only shares CSF RC.RP-02: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.