DORA · Chapter VI: Information sharing
Art.45(1)
Information-sharing arrangements on cyber threat information and intelligence
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter VI: Information sharing
csf 2.0DE.AE-07 ID.RA-02 ID.RA-03
topicsThreat Intelligence
frameworks0 6 3
Official textFinancial entities may exchange amongst themselves cyber threat information and intelligence, including indicators of compromise, tactics, techniques, and procedures, cyber security alerts and configuration tools, to the extent that such information and intelligence sharing:Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-07ID.RA-02ID.RA-03 | Cyber threat intelligence and other contextual information are integrated into the analysis; Cyber threat intelligence is received from information sharing forums and sources… | Editorial | Same topic: Threat Intelligence (editorial pick) |
| ISO 27001 | A.5.7 | Threat intelligence | Editorial | Same topic: Threat Intelligence (editorial pick)5 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.2CC3.3CC3.4 | Risk identification and analysis; Considering the potential for fraud… | No mapping. Only shares CSF ID.RA-03: related, not a mapping | |
| PCI DSS | 6.3.1 | Vulnerabilities identified and risk-ranked | Editorial | Same topic: Threat Intelligence (editorial pick)4 loosely related (not mappings)6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF DE.AE-07: related, not a mapping 12.3.1 Targeted risk analysis for flexible-frequency requirements Only shares CSF ID.RA-03: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF DE.AE-07: related, not a mapping |
| CMMC | SI.L2-3.14.3 | Security Alerts & Advisories | Editorial | Same topic: Threat Intelligence (editorial pick)1 loosely related (not mappings) |
| 800-53 | PM-15PM-16SI-5 | Security and Privacy Groups and Associations; Threat Awareness Program… | Editorial | Same topic: Threat Intelligence (editorial pick) |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.316(a) | Risk Analysis; Risk Management… | No mapping. Only shares CSF DE.AE-07, ID.RA-03: related, not a mapping | |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | No mapping. Only shares CSF ID.RA-03: related, not a mapping | |
| NIS2 | 2.14.36.10 | Risk management framework; Crisis management… | No mapping. Only shares CSF ID.RA-02, ID.RA-03, DE.AE-07: related, not a mapping | |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | Same topic: Threat Intelligence (editorial pick)1 loosely related (not mappings)Para 21 Timely controls commensurate with risk and asset life-cycle Only shares CSF ID.RA-03: related, not a mapping |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.