Key contractual provisions

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter V: ICT third-party risk csf 2.0DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.AM-04 ID.RA-10 PR.IR-01 PR.PS-01 topicsCloud Security, Vendor Risk Mgmt frameworks0 12 0

Official textThe contractual arrangements on the use of ICT services shall include at least the following elements:Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.30(2) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.AM-04 ID.RA-10 PR.IR-01 PR.PS-01	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick)
ISO 27001	A.5.19 A.5.20 A.5.22 A.5.23	Information security in supplier relationships; Addressing information security within supplier agreements…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) 14 loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.8 Management of technical vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.9 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 6 more in the downloads
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.4 CIS 15.5 CIS 15.6 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 36 loosely related (not mappings) CIS 1.2 Address Unauthorized Assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.3 Utilize an Active Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.4 Use Dynamic Host Configuration Protocol (DHCP) Logging to Update Enterprise Asset Inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 1.5 Use a Passive Asset Discovery Tool Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 2.3 Address Unauthorized Software Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 2.4 Utilize Automated Software Inventory Tools Loosely related Only shares CSF ID.AM-04: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Loosely related Only shares CSF PR.IR-01: related, not a mapping CIS 4.1 Establish and Maintain a Secure Configuration Process Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 28 more in the downloads
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 5 loosely related (not mappings) CC5.2 General controls over technology Loosely related Only shares CSF PR.PS-01: related, not a mapping CC6.1 Logical access security over information assets Loosely related Only shares CSF ID.AM-04: related, not a mapping CC6.6 Protection against threats from outside system boundaries Loosely related Only shares CSF PR.IR-01: related, not a mapping CC6.7 Restricting transmission, movement and removal of information Loosely related Only shares CSF PR.PS-01: related, not a mapping CC7.1 Detecting configuration changes and new vulnerabilities Loosely related Only shares CSF PR.PS-01: related, not a mapping
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 24 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, PR.IR-01: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-06, PR.IR-01: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07, PR.IR-01: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-06, PR.IR-01: related, not a mapping 1.2.1 Configuration standards for network security controls Loosely related Only shares CSF PR.IR-01: related, not a mapping 1.3.1 Inbound traffic to the CDE restricted Loosely related Only shares CSF PR.IR-01: related, not a mapping …and 16 more in the downloads
CMMC	AC.L2-3.1.20	External Connections	Editorial	Same topic: Cloud Security (editorial pick) 23 loosely related (not mappings) RA.L2-3.11.1 Risk Assessments Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10: related, not a mapping CM.L2-3.4.9 User-Installed Software Loosely related Only shares CSF DE.CM-06, PR.PS-01: related, not a mapping AC.L2-3.1.2 Transaction & Function Control Loosely related Only shares CSF PR.IR-01: related, not a mapping AC.L2-3.1.3 Control CUI Flow Loosely related Only shares CSF PR.IR-01: related, not a mapping AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-04: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping CM.L2-3.4.1 System Baselining Loosely related Only shares CSF PR.PS-01: related, not a mapping CM.L2-3.4.2 Security Configuration Enforcement Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 15 more in the downloads
800-53	AC-20 SA-4 SA-9 SR-6	Use of External Systems; Acquisition Process…	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 27 loosely related (not mappings) RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping AC-3 Access Enforcement Loosely related Only shares CSF PR.IR-01: related, not a mapping AC-4 Information Flow Enforcement Loosely related Only shares CSF PR.IR-01: related, not a mapping AC-19(5) Full Device or Container-based Encryption Loosely related Only shares CSF PR.PS-01: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping CM-2 Baseline Configuration Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-3 Configuration Change Control Loosely related Only shares CSF PR.PS-01: related, not a mapping CM-4 Impact Analyses Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 19 more in the downloads
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 19 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-06, PR.IR-01: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-06, PR.IR-01: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 11 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Cloud Security, Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Art.30(1) Records of processing activities Loosely related Only shares CSF ID.AM-04: related, not a mapping
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Editorial	Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) 5 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping 6.3 Configuration management Loosely related Only shares CSF PR.PS-01: related, not a mapping 6.7 Network security Loosely related Only shares CSF PR.IR-01: related, not a mapping 6.8 Network segmentation Loosely related Only shares CSF PR.IR-01: related, not a mapping 12.4 Asset inventory Loosely related Only shares CSF ID.AM-04: related, not a mapping
Essential Eight	ISM-1412 ISM-1485 ISM-1486 ISM-1487	Web browsers are hardened using ASD and vendor hardening guidance, with the most…; Web browsers do not process web advertisements from the internet…	Loosely related	No mapping. Only shares CSF PR.PS-01: related, not a mapping +28 more loosely related (not mappings) ISM-1488 Microsoft Office macros in files originating from the internet are blocked Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1489 Microsoft Office macro security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1542 Microsoft Office is configured to prevent activation of Object Linking and Embedding… Loosely related Only shares CSF PR.PS-01: related, not a mapping ISM-1585 Web browser security settings cannot be changed by human users Loosely related Only shares CSF PR.PS-01: related, not a mapping …and 24 more in the downloads
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) Para 20 Classify information assets by criticality and sensitivity Loosely related Only shares CSF ID.AM-04: related, not a mapping
Cyber Essentials	CE 4	User Access Control	Editorial	Same topic: Cloud Security (editorial pick) 3 loosely related (not mappings) CE 1 Firewalls Loosely related Only shares CSF PR.IR-01: related, not a mapping CE 2 Secure Configuration Loosely related Only shares CSF PR.PS-01: related, not a mapping CE 3 Security Update Management Loosely related Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.