DORA · Chapter V: ICT third-party risk
Art.28(5)
General principles
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter V: ICT third-party risk
csf 2.0DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10
topicsVendor Risk Mgmt
frameworks0 10 2
Official textFinancial entities may only enter into contractual arrangements with ICT third-party service providers that comply with appropriate information security standards. When those contractual arrangements concern critical or important functions, financial entities shall, prior to concluding the arrangements, take due consideration of the use, by ICT third-party service providers, of the most up-to-date and highest quality information security standards.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-04GV.SC-06GV.SC-07ID.RA-10 | External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| ISO 27001 | A.5.19A.5.20A.5.22 | Information security in supplier relationships; Addressing information security within supplier agreements… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)6 loosely related (not mappings)A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-06: related, not a mapping |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.4CIS 15.5CIS 15.6CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF DE.CM-06: related, not a mapping |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| PCI DSS | 12.8.112.8.212.8.312.8.412.8.5 | List of third-party service providers kept; Written agreements with service providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)11 loosely related (not mappings)1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-07: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Only shares CSF DE.CM-06: related, not a mapping …and 3 more in the downloads |
| CMMC | RA.L2-3.11.1CA.L2-3.12.3CM.L2-3.4.9SI.L2-3.14.6 | Risk Assessments; Security Control Monitoring… | No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10…: related, not a mapping+1 more loosely related (not mappings) | |
| 800-53 | SA-4SA-9SR-6 | Acquisition Process; External System Services… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)6 loosely related (not mappings) |
| HIPAA | §164.308(b)(1)§164.314(a) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)10 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-06: related, not a mapping …and 2 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 16Para 22Para 28Para 34 | Assess third parties' information security capability; Evaluate the design of third parties' controls… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.