DORA · Chapter V: ICT third-party risk
Art.29(2)
Preliminary assessment of ICT concentration risk at entity level
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter V: ICT third-party risk
csf 2.0GV.SC-01 GV.SC-03 GV.SC-05 GV.SC-09 ID.RA-09
topicsSupply Chain Risk
frameworks0 9 2
Official textWhere the contractual arrangements on the use of ICT services supporting critical or important functions include the possibility that an ICT third-party service provider further subcontracts ICT services supporting a critical or important function to other ICT third-party service providers, financial entities shall weigh benefits and risks that may arise in connection with such subcontracting, in particular in the case of an ICT subcontractor established in a third-country. Where contractual arrangements concern ICT services supporting critical or important functions, financial entities shall duly consider the insolvency law provisions that would apply in the event of the ICT third-party service provider’s bankruptcy as well as any constraint that may arise in respect to the urgent recovery of the financial entity’s data. Where contractual arrangements on the use of ICT services supporting critical or important functions are concluded with an ICT third-party service provider established in a third country, financial entities shall, in addition to the considerations referred to in the second subparagraph, also consider the compliance with Union data protection rules and the effective enforcement of the law in that third country. Where the contractual arrangements on the use of ICT services supporting critical or important functions provide for subcontracting, financial entities shall assess whether and how potentially long or complex chains of subcontracting may impact their ability to fully monitor the contracted functions and the ability of the competent authority to effectively supervise the financial entity in that respect.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.SC-01GV.SC-03GV.SC-05GV.SC-09ID.RA-09 | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders; Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes… | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| ISO 27001 | A.5.19A.5.21 | Information security in supplier relationships; Managing information security in the ICT supply chain | Editorial | Same topic: Supply Chain Risk (editorial pick)8 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05, GV.SC-09…: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-01, GV.SC-09, ID.RA-09: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05: related, not a mapping |
| CIS v8.1 | CIS 15.2 | Establish and Maintain a Service Provider Management Policy | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| PCI DSS | 6.3.212.8.1 | Inventory of custom software and its components; List of third-party service providers kept | Editorial | Same topic: Supply Chain Risk (editorial pick)18 loosely related (not mappings)6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09, ID.RA-09: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.SC-01, GV.SC-03, GV.SC-09: related, not a mapping 12.8.3 Due diligence before engaging service providers Only shares CSF GV.SC-01, GV.SC-03, GV.SC-05: related, not a mapping 12.8.5 Responsibilities split with each provider documented Only shares CSF GV.SC-01, GV.SC-05, GV.SC-09: related, not a mapping 6.2.3 Custom code reviewed before release Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.SC-03, GV.SC-09: related, not a mapping …and 10 more in the downloads |
| CMMC | RA.L2-3.11.1 | Risk Assessments | No mapping. Only shares CSF GV.SC-03, GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping | |
| 800-53 | PM-30SR-2SR-3SR-11 | Supply Chain Risk Management Strategy; Supply Chain Risk Management Plan… | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| HIPAA | §164.308(b)(4)§164.314(a)§164.314(a)(2)(i)§164.314(a)(2)(iii) | Written Contract or Other Arrangement; Business Associate Contracts or Other Arrangements… | No mapping. Only shares CSF GV.SC-05, GV.SC-09, ID.RA-09: related, not a mapping+30 more loosely related (not mappings)§164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF GV.SC-05, GV.SC-09: related, not a mapping …and 26 more in the downloads | |
| GDPR | Art.28(1) | Processor | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| NIS2 | 5.16.1 | Supply chain security policy; Security in acquisition of ICT services, ICT systems or ICT products | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 16Para 22 | Assess third parties' information security capability; Evaluate the design of third parties' controls | Editorial | Same topic: Supply Chain Risk (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.