DORA · Chapter II: ICT risk management
Art.11(6)
Response and recovery
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0GV.OC-04 PR.IR-03 RC.RP-02 RC.RP-04 RC.RP-05
topicsBusiness Continuity, Disaster Recovery
frameworks0 10 2
Official textAs part of their comprehensive ICT risk management, financial entities shall: For the purposes of the first subparagraph, point (a), financial entities, other than microenterprises, shall include in the testing plans scenarios of cyber-attacks and switchovers between the primary ICT infrastructure and the redundant capacity, backups and redundant facilities necessary to meet the obligations set out in Article 12. Financial entities shall regularly review their ICT business continuity policy and ICT response and recovery plans, taking into account the results of tests carried out in accordance with the first subparagraph and recommendations stemming from audit checks or supervisory reviews.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-04PR.IR-03RC.RP-02RC.RP-04RC.RP-05 | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated; Mechanisms are implemented to achieve resilience requirements in normal and adverse situations… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| ISO 27001 | A.5.29A.5.30A.8.14 | Information security during disruption; ICT readiness for business continuity… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)8 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-04, PR.IR-03: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.OC-04: related, not a mapping A.8.27 Secure system architecture and engineering principles Only shares CSF PR.IR-03: related, not a mapping |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Same topic: Disaster Recovery (editorial pick) |
| SOC 2 | A1.1A1.2A1.3CC9.1 | Capacity management to meet availability commitments; Environmental protections, backups and recovery infrastructure… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)10 loosely related (not mappings)1.2.3 Accurate network diagram maintained Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping 12.5.1 Inventory of in-scope system components Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping 12.10.2 Incident response plan reviewed and tested annually Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Only shares CSF RC.RP-05: related, not a mapping …and 2 more in the downloads |
| CMMC | IR.L2-3.6.1SC.L2-3.13.2 | Incident Handling; Security Engineering | No mapping. Only shares CSF RC.RP-02, PR.IR-03: related, not a mapping | |
| 800-53 | CP-2(8)CP-7CP-10 | Identify Critical Assets; Alternate Processing Site… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)14 loosely related (not mappings)PM-11 Mission and Business Process Definition Only shares CSF GV.OC-04, RC.RP-04: related, not a mapping …and 6 more in the downloads |
| HIPAA | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C)§164.308(a)(7)(ii)(D) | Disaster Recovery Plan; Emergency Mode Operation Plan… | Editorial | Same topic: Disaster Recovery, Business Continuity (editorial pick)8 loosely related (not mappings)§164.308(a)(6) Security Incident Procedures Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping §164.308(a)(6)(ii) Response and Reporting Only shares CSF RC.RP-02, RC.RP-04: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF GV.OC-04: related, not a mapping |
| GDPR | Art.32(1)(b)Art.32(1)(c) | Security of processing; Security of processing | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick)1 loosely related (not mappings)Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.RP-05: related, not a mapping |
| NIS2 | 4.14.24.3 | Business continuity and disaster recovery plan; Backup management… | Editorial | Same topic: Business Continuity, Disaster Recovery (editorial pick) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | Editorial | Same topic: Disaster Recovery (editorial pick) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.