DORA · Chapter II: ICT risk management
Art.14(2)
Communication
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0RS.CO-03
topicsCommunication
frameworks0 8 3
Official textAs part of the ICT risk management framework, financial entities shall implement communication policies for internal staff and for external stakeholders. Communication policies for staff shall take into account the need to differentiate between staff involved in ICT risk management, in particular the staff responsible for response and recovery, and staff that needs to be informed.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.CO-03 | Information is shared with designated internal and external stakeholders | Editorial | Same topic: Communication (editorial pick) |
| ISO 27001 | A.5.6Clause 7.4 | Contact with special interest groups; Communication | Editorial | Same topic: Communication (editorial pick)1 loosely related (not mappings) |
| CIS v8.1 | CIS 17.2CIS 17.6 | Establish and Maintain Contact Information for Reporting Security Incidents; Define Mechanisms for Communicating During Incident Response | Editorial | Same topic: Communication (editorial pick) |
| SOC 2 | CC2.3 | Communication with external parties | Editorial | Same topic: Communication (editorial pick) |
| PCI DSS | 12.8.212.8.412.10.112.10.6 | Written agreements with service providers; Service provider compliance monitored annually… | No mapping. Only shares CSF RS.CO-03: related, not a mapping | |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Communication (editorial pick)1 loosely related (not mappings) |
| 800-53 | IR-7 | Incident Response Assistance | Editorial | Same topic: Communication (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(1)(ii)(D)§164.308(a)(6)§164.308(a)(6)(ii)§164.314(a)(2)(i) | Information System Activity Review; Security Incident Procedures… | No mapping. Only shares CSF RS.CO-03: related, not a mapping+2 more loosely related (not mappings)§164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.CO-03: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-03: related, not a mapping | |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 4.3 | Crisis management | Editorial | Same topic: Communication (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 25 | Response plans cover all stages and escalation | Editorial | Same topic: Communication (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.