DORA · Chapter II: ICT risk management
Art.13(2)
Learning and evolving
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0ID.IM-03 RC.RP-06 RS.AN-03 RS.AN-06 RS.AN-07
topicsForensics, Lessons Learned
frameworks0 9 3
Official textFinancial entities shall put in place post ICT-related incident reviews after a major ICT-related incident disrupts their core activities, analysing the causes of disruption and identifying required improvements to the ICT operations or within the ICT business continuity policy referred to in Article 11. Financial entities, other than microenterprises, shall, upon request, communicate to the competent authorities, the changes that were implemented following post ICT-related incident reviews as referred to in the first subparagraph. The post ICT-related incident reviews referred to in the first subparagraph shall determine whether the established procedures were followed and the actions taken were effective, including in relation to the following:Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-03RC.RP-06RS.AN-03RS.AN-06RS.AN-07 | Improvements are identified from execution of operational processes, procedures, and activities; The end of incident recovery is declared based on criteria, and incident-related documentation is completed… | Editorial | Same topic: Lessons Learned, Forensics (editorial pick) |
| ISO 27001 | A.5.27A.5.28Clause 10.1 | Learning from information security incidents; Collection of evidence… | Editorial | Same topic: Lessons Learned, Forensics (editorial pick) |
| CIS v8.1 | CIS 17.8 | Conduct Post-Incident Reviews | Editorial | Same topic: Lessons Learned (editorial pick) |
| SOC 2 | CC7.4CC7.5 | Responding to identified security incidents; Recovering from identified security incidents | Editorial | Same topic: Forensics, Lessons Learned (editorial pick) |
| PCI DSS | 10.3.212.10.6 | Logs protected from modification; Plan updated from lessons learned and industry changes | Editorial | Same topic: Forensics, Lessons Learned (editorial pick)10 loosely related (not mappings)10.2.2 Log entries record who, what, when, where and outcome Only shares CSF RS.AN-03, RS.AN-07: related, not a mapping 10.3.3 Logs promptly backed up to a central server Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping 10.5.1 Audit logs retained 12 months, three immediately available Only shares CSF RC.RP-06, RS.AN-06: related, not a mapping …and 2 more in the downloads |
| CMMC | AU.L2-3.3.6IR.L2-3.6.1 | Reduction & Reporting; Incident Handling | Editorial | Same topic: Forensics, Lessons Learned (editorial pick)1 loosely related (not mappings) |
| 800-53 | AU-7IR-4SI-2(7) | Audit Record Reduction and Report Generation; Incident Handling… | Editorial | Same topic: Forensics, Lessons Learned (editorial pick) |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii)§164.308(a)(1)(ii)(D)§164.312(b) | Security Incident Procedures; Response and Reporting… | No mapping. Only shares CSF ID.IM-03, RC.RP-06, RS.AN-03, RS.AN-06…: related, not a mapping+3 more loosely related (not mappings)§164.314(a)(2)(i) Business Associate Contracts Only shares CSF ID.IM-03, RS.AN-06, RS.AN-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.IM-03, RS.AN-06, RS.AN-07: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.AN-06, RS.AN-07: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 3.53.6 | Incident response; Post-incident reviews | Editorial | Same topic: Forensics, Lessons Learned (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 25 | Response plans cover all stages and escalation | Editorial | Same topic: Lessons Learned (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.