Key contractual provisions

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter V: ICT third-party risk csf 2.0DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10 topicsVendor Risk Mgmt frameworks0 10 2

Official textThe contractual arrangements on the use of ICT services supporting critical or important functions shall include, in addition to the elements referred to in paragraph 2, at least the following: By way of derogation from point (e), the ICT third-party service provider and the financial entity that is a microenterprise may agree that the financial entity’s rights of access, inspection and audit can be delegated to an independent third party, appointed by the ICT third-party service provider, and that the financial entity is able to request information and assurance on the ICT third-party service provider’s performance from the third party at any time.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.30(3) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-06: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.SC-06: related, not a mapping
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.4 CIS 15.5 CIS 15.6 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 11 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-06: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-07: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Loosely related Only shares CSF DE.CM-06: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 3 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.3 CM.L2-3.4.9 SI.L2-3.14.6	Risk Assessments; Security Control Monitoring…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10…: related, not a mapping +1 more loosely related (not mappings) SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-06: related, not a mapping
800-53	SA-4 SA-9 SR-6	Acquisition Process; External System Services…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping PS-7 External Personnel Security Loosely related Only shares CSF DE.CM-06: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-07: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-06: related, not a mapping
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 10 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 2 more in the downloads
GDPR	Art.28(1)Art.28(3)	Processor; Processor	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.