DORA · Chapter II: ICT risk management
Art.11(5)
Response and recovery
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0GV.OC-01 GV.OC-04 GV.OC-05
topicsBusiness Environment
frameworks0 5 5
Official textAs part of the overall business continuity policy, financial entities shall conduct a business impact analysis (BIA) of their exposures to severe business disruptions. Under the BIA, financial entities shall assess the potential impact of severe business disruptions by means of quantitative and qualitative criteria, using internal and external data and scenario analysis, as appropriate. The BIA shall consider the criticality of identified and mapped business functions, support processes, third-party dependencies and information assets, and their interdependencies. Financial entities shall ensure that ICT assets and ICT services are designed and used in full alignment with the BIA, in particular with regard to adequately ensuring the redundancy of all critical components.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-01GV.OC-04GV.OC-05 | The organizational mission is understood and informs cybersecurity risk management; Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated… | Editorial | Same topic: Business Environment (editorial pick) |
| ISO 27001 | Clause 4.1Clause 4.2 | Understanding the organization and its context; Understanding the needs and expectations of interested parties | Editorial | Same topic: Business Environment (editorial pick)8 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-04: related, not a mapping Clause 6.1 Actions to address risks and opportunities Only shares CSF GV.OC-01: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.1 | Objectives specified clearly enough to identify risks | Editorial | Same topic: Business Environment (editorial pick) |
| PCI DSS | 12.5.2 | PCI DSS scope confirmed annually and on change | Editorial | Same topic: Business Environment (editorial pick)9 loosely related (not mappings)12.5.1 Inventory of in-scope system components Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.OC-05: related, not a mapping 12.1.1 Information security policy established and published Only shares CSF GV.OC-01: related, not a mapping 12.8.4 Service provider compliance monitored annually Only shares CSF GV.OC-05: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.OC-05: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.OC-05: related, not a mapping …and 1 more in the downloads |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| 800-53 | PM-11RA-9 | Mission and Business Process Definition; Criticality Analysis | Editorial | Same topic: Business Environment (editorial pick)7 loosely related (not mappings)PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping |
| HIPAA | §164.308(a)(7)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D) | Contingency Plan; Disaster Recovery Plan… | No mapping. Only shares CSF GV.OC-04: related, not a mapping+10 more loosely related (not mappings)§164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF GV.OC-04: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF GV.OC-05: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.OC-05: related, not a mapping …and 6 more in the downloads | |
| GDPR | Art.32(1)(b) | Security of processing | No mapping. Only shares CSF GV.OC-04: related, not a mapping | |
| NIS2 | 4.15.15.213.1 | Business continuity and disaster recovery plan; Supply chain security policy… | No mapping. Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping | |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.