DORA · Chapter IV: Resilience testing
Art.24(1)
General requirements for the performance of digital operational resilience testing
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter IV: Resilience testing
csf 2.0GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06
topicsRisk Management
frameworks0 10 3
Official textFor the purpose of assessing preparedness for handling ICT-related incidents, of identifying weaknesses, deficiencies and gaps in digital operational resilience, and of promptly implementing corrective measures, financial entities, other than microenterprises, shall, taking into account the criteria set out in Article 4(2), establish, maintain and review a sound and comprehensive digital operational resilience testing programme as an integral part of the ICT risk-management framework referred to in Article 6.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Editorial | Same topic: Risk Management (editorial pick) |
| ISO 27001 | Clause 6.1.1Clause 6.1.3 | General; Information security risk treatment | Editorial | Same topic: Risk Management (editorial pick)2 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.1CC5.1CC9.1 | Objectives specified clearly enough to identify risks; Control activities that mitigate risks… | Editorial | Same topic: Risk Management (editorial pick) |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Editorial | Same topic: Risk Management (editorial pick)19 loosely related (not mappings)5.2.3.1 Re-evaluation frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 5.3.2.1 Scan frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 8.6.3 System account passwords protected and changed Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 11 more in the downloads |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Editorial | Same topic: Risk Management (editorial pick) |
| 800-53 | PM-9PM-28RA-7 | Risk Management Strategy; Risk Framing… | Editorial | Same topic: Risk Management (editorial pick)6 loosely related (not mappings)PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping |
| HIPAA | §164.308(a)(1)(ii)(B) | Risk Management | Editorial | Same topic: Risk Management (editorial pick)2 loosely related (not mappings) |
| GDPR | Art.24(1)Art.32(2) | Responsibility of the controller; Security of processing | Editorial | Same topic: Risk Management (editorial pick) |
| NIS2 | 2.17.1 | Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Editorial | Same topic: Risk Management (editorial pick)1 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.RM-03: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 13Para 15Para 27Para 31 | Board ultimately responsible for information security; Maintain a capability commensurate with threats… | Editorial | Same topic: Risk Management (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.