DORA · Chapter V: ICT third-party risk
Art.28(2)
General principles
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter V: ICT third-party risk
csf 2.0GV.SC-01 GV.SC-03 GV.SC-05 GV.SC-09 ID.RA-09
topicsSupply Chain Risk
frameworks0 9 2
Official textAs part of their ICT risk management framework, financial entities, other than entities referred to in Article 16(1), first subparagraph, and other than microenterprises, shall adopt, and regularly review, a strategy on ICT third-party risk, taking into account the multi-vendor strategy referred to in Article 6(9), where applicable. The strategy on ICT third-party risk shall include a policy on the use of ICT services supporting critical or important functions provided by ICT third-party service providers and shall apply on an individual basis and, where relevant, on a sub-consolidated and consolidated basis. The management body shall, on the basis of an assessment of the overall risk profile of the financial entity and the scale and complexity of the business services, regularly review the risks identified in respect to contractual arrangements on the use of ICT services supporting critical or important functions.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.SC-01GV.SC-03GV.SC-05GV.SC-09ID.RA-09 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes… | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| ISO 27001 | A.5.19A.5.21 | Information security in supplier relationships; Managing information security in the ICT supply chain | Editorial | Same topic: Supply Chain Risk (editorial pick)8 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-09, ID.RA-09: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05: related, not a mapping |
| CIS v8.1 | CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| PCI DSS | 6.3.212.8.1 | Inventory of custom software and its components; List of third-party service providers kept | Editorial | Same topic: Supply Chain Risk (editorial pick)18 loosely related (not mappings)6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, ID.RA-09: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping 12.8.3 Due diligence before engaging service providers Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF GV.SC-01, GV.SC-05, GV.SC-09: related, not a mapping 6.2.3 Custom code reviewed before release Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping …and 10 more in the downloads |
| CMMC | RA.L2-3.11.1 | Risk Assessments | No mapping. Only shares CSF GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping | |
| 800-53 | PM-30SR-2SR-3SR-11 | Supply Chain Risk Management Strategy; Supply Chain Risk Management Plan… | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| HIPAA | §164.308(b)(4)§164.314(a)§164.314(a)(2)(i)§164.314(a)(2)(iii) | Written Contract or Other Arrangement; Business Associate Contracts or Other Arrangements… | No mapping. Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping+30 more loosely related (not mappings)§164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF GV.SC-05, GV.SC-09: related, not a mapping …and 26 more in the downloads | |
| GDPR | Art.28(1) | Processor | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| NIS2 | 5.16.1 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 16Para 22 | Assess third parties' information security capability; Evaluate the design of third parties' controls | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.