DORA · Chapter V: ICT third-party risk
Art.28(3)
General principles
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter V: ICT third-party risk
csf 2.0DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10
topicsVendor Risk Mgmt
frameworks0 10 2
Official textAs part of their ICT risk management framework, financial entities shall maintain and update at entity level, and at sub-consolidated and consolidated levels, a register of information in relation to all contractual arrangements on the use of ICT services provided by ICT third-party service providers. The contractual arrangements referred to in the first subparagraph shall be appropriately documented, distinguishing between those that cover ICT services supporting critical or important functions and those that do not. Financial entities shall report at least yearly to the competent authorities on the number of new arrangements on the use of ICT services, the categories of ICT third-party service providers, the type of contractual arrangements and the ICT services and functions which are being provided. Financial entities shall make available to the competent authority, upon its request, the full register of information or, as requested, specified sections thereof, along with any information deemed necessary to enable the effective supervision of the financial entity. Financial entities shall inform the competent authority in a timely manner about any planned contractual arrangement on the use of ICT services supporting critical or important functions as well as when a function has become critical or important.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-04GV.SC-06GV.SC-07ID.RA-10 | External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| ISO 27001 | A.5.19A.5.20A.5.22 | Information security in supplier relationships; Addressing information security within supplier agreements… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)6 loosely related (not mappings)A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-06: related, not a mapping |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.4CIS 15.5CIS 15.6CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF DE.CM-06: related, not a mapping |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| PCI DSS | 12.8.112.8.212.8.312.8.412.8.5 | List of third-party service providers kept; Written agreements with service providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)11 loosely related (not mappings)1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-07: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Only shares CSF DE.CM-06: related, not a mapping …and 3 more in the downloads |
| CMMC | RA.L2-3.11.1CA.L2-3.12.3CM.L2-3.4.9SI.L2-3.14.6 | Risk Assessments; Security Control Monitoring… | No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10…: related, not a mapping+1 more loosely related (not mappings) | |
| 800-53 | SA-4SA-9SR-6 | Acquisition Process; External System Services… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)6 loosely related (not mappings) |
| HIPAA | §164.308(b)(1)§164.314(a) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)10 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-06: related, not a mapping …and 2 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.