DORA · Chapter II: ICT risk management
Art.11(4)
Response and recovery
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0GV.OC-04 PR.IR-03 RC.RP-04
topicsBusiness Continuity
frameworks0 8 2
Official textFinancial entities shall put in place, maintain and periodically test appropriate ICT business continuity plans, notably with regard to critical or important functions outsourced or contracted through arrangements with ICT third-party service providers.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-04PR.IR-03RC.RP-04 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Mechanisms are implemented to achieve resilience requirements in normal and adverse situations… | Editorial | Same topic: Business Continuity (editorial pick) |
| ISO 27001 | A.5.29A.5.30A.8.14 | Information security during disruption; ICT readiness for business continuity… | Editorial | Same topic: Business Continuity (editorial pick)7 loosely related (not mappings)Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-04: related, not a mapping A.8.27 Secure system architecture and engineering principles Only shares CSF PR.IR-03: related, not a mapping |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | No mapping. Only shares CSF PR.IR-03: related, not a mapping | |
| SOC 2 | A1.1A1.2CC9.1 | Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure… | Editorial | Same topic: Business Continuity (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Business Continuity (editorial pick)7 loosely related (not mappings)12.5.1 Inventory of in-scope system components Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-04: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.OC-04: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Only shares CSF PR.IR-03: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF PR.IR-03: related, not a mapping |
| CMMC | SC.L2-3.13.2 | Security Engineering | No mapping. Only shares CSF PR.IR-03: related, not a mapping | |
| 800-53 | CP-2(8)CP-7 | Identify Critical Assets; Alternate Processing Site | Editorial | Same topic: Business Continuity (editorial pick)13 loosely related (not mappings)PM-11 Mission and Business Process Definition Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping …and 5 more in the downloads |
| HIPAA | §164.308(a)(7)(ii)(C) | Emergency Mode Operation Plan | Editorial | Same topic: Business Continuity (editorial pick)10 loosely related (not mappings)§164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF GV.OC-04: related, not a mapping …and 2 more in the downloads |
| GDPR | Art.32(1)(b) | Security of processing | Editorial | Same topic: Business Continuity (editorial pick)1 loosely related (not mappings) |
| NIS2 | 4.14.3 | Business continuity and disaster recovery plan; Crisis management | Editorial | Same topic: Business Continuity (editorial pick) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | No mapping. Only shares CSF PR.IR-03: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.