General principles

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter V: ICT third-party risk csf 2.0DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.AM-04 ID.RA-10 PR.IR-01 PR.PS-01 topicsCloud Security, Vendor Risk Mgmt frameworks0 12 0

Official textFor ICT services supporting critical or important functions, financial entities shall put in place exit strategies. The exit strategies shall take into account risks that may emerge at the level of ICT third-party service providers, in particular a possible failure on their part, a deterioration of the quality of the ICT services provided, any business disruption due to inappropriate or failed provision of ICT services or any material risk arising in relation to the appropriate and continuous deployment of the respective ICT service, or the termination of contractual arrangements with ICT third-party service providers under any of the circumstances listed in paragraph 7. Financial entities shall ensure that they are able to exit contractual arrangements without: Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically. Financial entities shall identify alternative solutions and develop transition plans enabling them to remove the contracted ICT services and the relevant data from the ICT third-party service provider and to securely and integrally transfer them to alternative providers or reincorporate them in-house. Financial entities shall have appropriate contingency measures in place to maintain business continuity in the event of the circumstances referred to in the first subparagraph.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.28(8) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.AM-04 ID.RA-10 PR.IR-01 PR.PS-01	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick)
ISO 27001	A.5.19 A.5.20 A.5.22 A.5.23	Information security in supplier relationships; Addressing information security within supplier agreements…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) 14 loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.8 Management of technical vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.9 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.4 CIS 15.5 CIS 15.6 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 36 loosely related (not mappings) CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 4.1 Establish and Maintain a Secure Configuration Process Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 28 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 5 loosely related (not mappings) CC5.2 General controls over technology Loosely related Only shares CSF PR.PS-01: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.IR-01: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.PS-01: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 24 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, PR.IR-01: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-06, PR.IR-01: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, PR.IR-01: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-06, PR.IR-01: related, not a mapping 1.2.1 Configuration standards for network security controls Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.3.1 Inbound traffic to the CDE restricted Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 16 more in the downloads
CMMC	AC.L2-3.1.20	External Connections	Editorial	Same topic: Cloud Security (editorial pick) 23 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06, PR.PS-01: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.IR-01: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.IR-01: related, not a mapping AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-04: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping CM.L2-3.4.1 System Baselining Loosely related Only shares CSF PR.PS-01: related, not a mapping CM.L2-3.4.2 Security Configuration Enforcement Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 15 more in the downloads
800-53	AC-20 SA-4 SA-9 SR-6	Use of External Systems; Acquisition Process…	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 27 loosely related (not mappings) RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping AC-3 Access Enforcement Loosely related Only shares CSF PR.IR-01: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF PR.IR-01: related, not a mapping AC-19(5) Full Device or Container-based Encryption Loosely related Only shares CSF PR.PS-01: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping CM-2 Baseline Configuration Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-3 Configuration Change Control Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-4 Impact Analyses Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 19 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 19 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-06, PR.IR-01: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-06, PR.IR-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 11 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) 5 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping
Essential Eight	ISM-1412 ISM-1485 ISM-1486 ISM-1487	Web browsers are hardened using ASD and vendor hardening guidance, with the most…; Web browsers do not process web advertisements from the internet…	Loosely related	No mapping. Only shares CSF PR.PS-01: related, not a mapping +28 more loosely related (not mappings) ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1542 Microsoft Office is configured to prevent activation of Object Linking and Embedding… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1585 Web browser security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 24 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-04: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Cloud Security (editorial pick) 3 loosely related (not mappings) CE 1 Firewalls Loosely related Only shares CSF PR.IR-01: related, not a mapping CE 2 Secure Configuration Loosely related Only shares CSF PR.PS-01: related, not a mapping CE 3 Security Update Management Loosely related Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.