DORA · Chapter II: ICT risk management
Art.14(1)
Communication
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0RS.CO-03
topicsCommunication
frameworks0 8 3
Official textAs part of the ICT risk management framework referred to in Article 6(1), financial entities shall have in place crisis communication plans enabling a responsible disclosure of, at least, major ICT-related incidents or vulnerabilities to clients and counterparts as well as to the public, as appropriate.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.CO-03 | Information is shared with designated internal and external stakeholders | Editorial | Same topic: Communication (editorial pick) |
| ISO 27001 | A.5.6Clause 7.4 | Contact with special interest groups; Communication | Editorial | Same topic: Communication (editorial pick)1 loosely related (not mappings) |
| CIS v8.1 | CIS 17.2CIS 17.6 | Establish and Maintain Contact Information for Reporting Security Incidents; Define Mechanisms for Communicating During Incident Response | Editorial | Same topic: Communication (editorial pick) |
| SOC 2 | CC2.3 | Communication with external parties | Editorial | Same topic: Communication (editorial pick) |
| PCI DSS | 12.8.212.8.412.10.112.10.6 | Written agreements with service providers; Service provider compliance monitored annually… | No mapping. Only shares CSF RS.CO-03: related, not a mapping | |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Communication (editorial pick)1 loosely related (not mappings) |
| 800-53 | IR-7 | Incident Response Assistance | Editorial | Same topic: Communication (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)§164.314(a)(2)(i) | Information System Activity Review; Security Incident Procedures… | No mapping. Only shares CSF RS.CO-03: related, not a mapping+2 more loosely related (not mappings)§164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.CO-03: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-03: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 4.3 | Crisis management | Editorial | Same topic: Communication (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 25 | Response plans cover all stages and escalation | Editorial | Same topic: Communication (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.