DORA · Chapter II: ICT risk management
Art.12(4)
Backup policies and procedures, restoration and recovery procedures and methods
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0PR.IR-03 RC.RP-02 RC.RP-05
topicsDisaster Recovery
frameworks0 10 2
Official textFinancial entities, other than microenterprises, shall maintain redundant ICT capacities equipped with resources, capabilities and functions that are adequate to ensure business needs. Microenterprises shall assess the need to maintain such redundant ICT capacities based on their risk profile.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.IR-03RC.RP-02RC.RP-05 | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations; Recovery actions are selected, scoped, prioritized, and performed… | Editorial | Same topic: Disaster Recovery (editorial pick) |
| ISO 27001 | A.5.30A.8.14 | ICT readiness for business continuity; Redundancy of information processing facilities | Editorial | Same topic: Disaster Recovery (editorial pick)6 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping A.8.27 Secure system architecture and engineering principles Only shares CSF PR.IR-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF PR.IR-03: related, not a mapping |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Same topic: Disaster Recovery (editorial pick) |
| SOC 2 | A1.2A1.3 | Environmental protections, backups and recovery infrastructure; Testing recovery plan procedures | Editorial | Same topic: Disaster Recovery (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Disaster Recovery (editorial pick)7 loosely related (not mappings)12.10.2 Incident response plan reviewed and tested annually Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF PR.IR-03, RC.RP-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-02: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Only shares CSF RC.RP-05: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF RC.RP-05: related, not a mapping |
| CMMC | IR.L2-3.6.1SC.L2-3.13.2 | Incident Handling; Security Engineering | No mapping. Only shares CSF RC.RP-02, PR.IR-03: related, not a mapping | |
| 800-53 | CP-7CP-10 | Alternate Processing Site; System Recovery and Reconstitution | Editorial | Same topic: Disaster Recovery (editorial pick)9 loosely related (not mappings)…and 1 more in the downloads |
| HIPAA | §164.308(a)(7)(ii)(B)§164.308(a)(7)(ii)(D) | Disaster Recovery Plan; Testing and Revision Procedure | Editorial | Same topic: Disaster Recovery (editorial pick)3 loosely related (not mappings)§164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF RC.RP-02, RC.RP-05: related, not a mapping |
| GDPR | Art.32(1)(c) | Security of processing | Editorial | Same topic: Disaster Recovery (editorial pick)2 loosely related (not mappings)Art.34(1) Communication of a personal data breach to the data subject Only shares CSF RC.RP-05: related, not a mapping |
| NIS2 | 4.14.2 | Business continuity and disaster recovery plan; Backup management | Editorial | Same topic: Disaster Recovery (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | Editorial | Same topic: Disaster Recovery (editorial pick) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.