DORA · Chapter II: ICT risk management
Art.11(7)
Response and recovery
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0RC.CO-03 RC.CO-04 RC.RP-05
topicsComms & Restore
frameworks0 8 2
Official textFinancial entities, other than microenterprises, shall have a crisis management function, which, in the event of activation of their ICT business continuity plans or ICT response and recovery plans, shall, inter alia, set out clear procedures to manage internal and external crisis communications in accordance with Article 14.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RC.CO-03RC.CO-04RC.RP-05 | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders; Public updates on incident recovery are shared using approved methods and messaging… | Editorial | Same topic: Comms & Restore (editorial pick) |
| ISO 27001 | A.5.26Clause 7.4 | Response to information security incidents; Communication | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| CIS v8.1 | CIS 17.6 | Define Mechanisms for Communicating During Incident Response | Editorial | Same topic: Comms & Restore (editorial pick) |
| SOC 2 | CC2.3CC7.5 | Communication with external parties; Recovering from identified security incidents | Editorial | Same topic: Comms & Restore (editorial pick) |
| PCI DSS | 12.10.112.10.36.2.310.4.1 | Incident response plan ready to activate; Incident response staff available around the clock… | No mapping. Only shares CSF RC.CO-03, RC.CO-04, RC.RP-05: related, not a mapping | |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| 800-53 | CP-10IR-6 | System Recovery and Reconstitution; Incident Reporting | Editorial | Same topic: Comms & Restore (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(C) | Security Incident Procedures; Response and Reporting… | No mapping. Only shares CSF RC.CO-03, RC.CO-04, RC.RP-05: related, not a mapping+9 more loosely related (not mappings)§164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF RC.CO-04, RC.RP-05: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RC.CO-03: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF RC.CO-04: related, not a mapping …and 5 more in the downloads | |
| GDPR | Art.34(1) | Communication of a personal data breach to the data subject | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| NIS2 | 4.3 | Crisis management | Editorial | Same topic: Comms & Restore (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | No mapping. Only shares CSF RC.RP-05: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.