DORA · Chapter II: ICT risk management
Art.13(3)
Learning and evolving
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0ID.IM-03 RC.RP-06
topicsLessons Learned
frameworks0 9 3
Official textLessons derived from the digital operational resilience testing carried out in accordance with Articles 26 and 27 and from real life ICT-related incidents, in particular cyber-attacks, along with challenges faced upon the activation of ICT business continuity plans and ICT response and recovery plans, together with relevant information exchanged with counterparts and assessed during supervisory reviews, shall be duly incorporated on a continuous basis into the ICT risk assessment process. Those findings shall form the basis for appropriate reviews of relevant components of the ICT risk management framework referred to in Article 6(1).Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.IM-03RC.RP-06 | Improvements are identified from execution of operational processes, procedures, and activities; The end of incident recovery is declared based on criteria, and incident-related documentation is completed | Editorial | Same topic: Lessons Learned (editorial pick) |
| ISO 27001 | A.5.27Clause 10.1 | Learning from information security incidents; Continual improvement | Editorial | Same topic: Lessons Learned (editorial pick)1 loosely related (not mappings) |
| CIS v8.1 | CIS 17.8 | Conduct Post-Incident Reviews | Editorial | Same topic: Lessons Learned (editorial pick) |
| SOC 2 | CC7.5 | Recovering from identified security incidents | Editorial | Same topic: Lessons Learned (editorial pick) |
| PCI DSS | 12.10.6 | Plan updated from lessons learned and industry changes | Editorial | Same topic: Lessons Learned (editorial pick) |
| CMMC | IR.L2-3.6.1 | Incident Handling | Editorial | Same topic: Lessons Learned (editorial pick) |
| 800-53 | IR-4 | Incident Handling | Editorial | Same topic: Lessons Learned (editorial pick)1 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii) | Security Incident Procedures; Response and Reporting | No mapping. Only shares CSF ID.IM-03, RC.RP-06: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 3.6 | Post-incident reviews | Editorial | Same topic: Lessons Learned (editorial pick) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 25 | Response plans cover all stages and escalation | Editorial | Same topic: Lessons Learned (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.