DORA · Chapter III: ICT-related incidents
Art.19(4)
Reporting of major ICT-related incidents and voluntary notification of significant cyber threats
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter III: ICT-related incidents
csf 2.0RS.CO-02
topicsReporting
frameworks0 12 1
Official textFinancial entities shall, within the time limits to be laid down in accordance with Article 20, first paragraph, point (a), point (ii), submit the following to the relevant competent authority:Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.CO-02 | Internal and external stakeholders are notified of incidents | Editorial | Same topic: Reporting (editorial pick) |
| ISO 27001 | A.5.5A.6.8 | Contact with authorities; Information security event reporting | Editorial | Same topic: Reporting (editorial pick)2 loosely related (not mappings) |
| CIS v8.1 | CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | Same topic: Reporting (editorial pick)1 loosely related (not mappings)CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-02: related, not a mapping |
| SOC 2 | CC2.3 | Communication with external parties | Editorial | Same topic: Reporting (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Reporting (editorial pick) |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Reporting (editorial pick)1 loosely related (not mappings) |
| 800-53 | IR-6 | Incident Reporting | Editorial | Same topic: Reporting (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)(ii) | Response and Reporting | Editorial | Same topic: Reporting (editorial pick)5 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RS.CO-02: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.CO-02: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-02: related, not a mapping |
| GDPR | Art.33(1)Art.34(1) | Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject | Editorial | Same topic: Reporting (editorial pick) |
| NIS2 | 3.3 | Event reporting | Editorial | Same topic: Reporting (editorial pick) |
| Essential Eight | ISM-0123ISM-0140 | Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | Same topic: Reporting (editorial pick) |
| CPS 234 | Para 35Para 36 | Notify APRA of material incidents within 72 hours; Notify APRA of material control weaknesses within 10 business days | Editorial | Same topic: Reporting (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.