DORA · Chapter III: ICT-related incidents
Art.19(3)
Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter III: ICT-related incidents
csf 2.0RS.CO-02
topicsReporting
frameworks0 12 1
Official textWhere a major ICT-related incident occurs and has an impact on the financial interests of clients, financial entities shall, without undue delay as soon as they become aware of it, inform their clients about the major ICT-related incident and about the measures that have been taken to mitigate the adverse effects of such incident. In the case of a significant cyber threat, financial entities shall, where applicable, inform their clients that are potentially affected of any appropriate protection measures which the latter may consider taking.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.CO-02 | Internal and external stakeholders are notified of incidents | Editorial | Same topic: Reporting (editorial pick) |
| ISO 27001 | A.5.5A.6.8 | Contact with authorities; Information security event reporting | Editorial | Same topic: Reporting (editorial pick)2 loosely related (not mappings) |
| CIS v8.1 | CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | Same topic: Reporting (editorial pick)1 loosely related (not mappings)CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-02: related, not a mapping |
| SOC 2 | CC2.3 | Communication with external parties | Editorial | Same topic: Reporting (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Reporting (editorial pick) |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Reporting (editorial pick)1 loosely related (not mappings) |
| 800-53 | IR-6 | Incident Reporting | Editorial | Same topic: Reporting (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)(ii) | Response and Reporting | Editorial | Same topic: Reporting (editorial pick)5 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RS.CO-02: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.CO-02: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-02: related, not a mapping |
| GDPR | Art.33(1)Art.34(1) | Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject | Editorial | Same topic: Reporting (editorial pick) |
| NIS2 | 3.3 | Event reporting | Editorial | Same topic: Reporting (editorial pick) |
| Essential Eight | ISM-0123ISM-0140 | Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | Same topic: Reporting (editorial pick) |
| CPS 234 | Para 35Para 36 | Notify APRA of material incidents within 72 hours; Notify APRA of material control weaknesses within 10 business days | Editorial | Same topic: Reporting (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.