DORA · Chapter II: ICT risk management
Art.12(6)
Backup policies and procedures, restoration and recovery procedures and methods
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0ID.IM-04 RC.RP-01 RC.RP-02
topicsRecovery Planning
frameworks0 9 2
Official textIn determining the recovery time and recovery point objectives for each function, financial entities shall take into account whether it is a critical or important function and the potential overall impact on market efficiency. Such time objectives shall ensure that, in extreme scenarios, the agreed service levels are met.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-04RC.RP-01RC.RP-02 | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved; The recovery portion of the incident response plan is executed once initiated from the incident response process… | Editorial | Same topic: Recovery Planning (editorial pick) |
| ISO 27001 | A.5.29A.5.30 | Information security during disruption; ICT readiness for business continuity | Editorial | Same topic: Recovery Planning (editorial pick)1 loosely related (not mappings)A.5.26 Response to information security incidents Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping |
| CIS v8.1 | CIS 11.1 | Establish and Maintain a Data Recovery Process | Editorial | Same topic: Recovery Planning (editorial pick) |
| SOC 2 | A1.3CC7.5 | Testing recovery plan procedures; Recovering from identified security incidents | Editorial | Same topic: Recovery Planning (editorial pick)1 loosely related (not mappings)A1.2 Environmental protections, backups and recovery infrastructure Only shares CSF RC.RP-02: related, not a mapping |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Recovery Planning (editorial pick)5 loosely related (not mappings)12.10.2 Incident response plan reviewed and tested annually Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping 12.10.3 Incident response staff available around the clock Only shares CSF ID.IM-04, RC.RP-01: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Only shares CSF ID.IM-04, RC.RP-02: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF RC.RP-02: related, not a mapping |
| CMMC | IR.L2-3.6.1 | Incident Handling | No mapping. Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping | |
| 800-53 | CP-2CP-10 | Contingency Plan; System Recovery and Reconstitution | Editorial | Same topic: Recovery Planning (editorial pick) |
| HIPAA | §164.308(a)(7)§164.308(a)(7)(ii)(B) | Contingency Plan; Disaster Recovery Plan | Editorial | Same topic: Recovery Planning (editorial pick)4 loosely related (not mappings)§164.308(a)(6)(ii) Response and Reporting Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF ID.IM-04, RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(6) Security Incident Procedures Only shares CSF RC.RP-01, RC.RP-02: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF ID.IM-04, RC.RP-02: related, not a mapping |
| GDPR | Art.32(1)(c) | Security of processing | Editorial | Same topic: Recovery Planning (editorial pick) |
| NIS2 | 4.1 | Business continuity and disaster recovery plan | Editorial | Same topic: Recovery Planning (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1515 | Restoration of data, applications and settings from backups to a common point in time… | No mapping. Only shares CSF RC.RP-02: related, not a mapping | |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.