Governance and organisation

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter II: ICT risk management csf 2.0PR.AT-01 PR.AT-02 topicsAwareness & Training frameworks0 10 3

Official textMembers of the management body of the financial entity shall actively keep up to date with sufficient knowledge and skills to understand and assess ICT risk and its impact on the operations of the financial entity, including by following specific training on a regular basis, commensurate to the ICT risk being managed.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.5(4) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AT-01 PR.AT-02	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Editorial	Same topic: Awareness & Training (editorial pick)
ISO 27001	A.6.3 Clause 7.3	Information security awareness, education and training; Awareness	Editorial	Same topic: Awareness & Training (editorial pick) 1 loosely related (not mappings) A.5.2 Information security roles and responsibilities Loosely related Only shares CSF PR.AT-02: related, not a mapping
CIS v8.1	CIS 14.1 CIS 14.2 CIS 14.3 CIS 14.4 CIS 14.5 CIS 14.6 CIS 14.7 CIS 14.8 CIS 14.9	Establish and Maintain a Security Awareness Program; Train Workforce Members to Recognize Social Engineering Attacks…	Editorial	Same topic: Awareness & Training (editorial pick)
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Editorial	Same topic: Awareness & Training (editorial pick)
PCI DSS	12.6.1 12.6.3	Formal security awareness programme; Awareness training on hire and at least annually	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF PR.AT-02: related, not a mapping 12.10.4 Incident response staff trained Loosely related Only shares CSF PR.AT-02: related, not a mapping 12.10.4.1 Training frequency set by targeted risk analysis Loosely related Only shares CSF PR.AT-02: related, not a mapping
CMMC	AT.L2-3.2.1 AT.L2-3.2.2 AT.L2-3.2.3	Role-Based Risk Awareness; Role-Based Training…	Editorial	Same topic: Awareness & Training (editorial pick)
800-53	AT-2 AT-3	Literacy Training and Awareness; Role-based Training	Editorial	Same topic: Awareness & Training (editorial pick)
HIPAA	§164.308(a)(5)§164.308(a)(5)(ii)(A)	Security Awareness and Training; Security Reminders	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping
GDPR	Art.39(1)(b)	Tasks of the data protection officer	Editorial	Same topic: Awareness & Training (editorial pick)
NIS2	8.1 8.2	Awareness raising and basic cyber hygiene practices; Security training	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF PR.AT-02: related, not a mapping 1.2 Roles, responsibilities and authorities Loosely related Only shares CSF PR.AT-02: related, not a mapping 10.1 Human resources security Loosely related Only shares CSF PR.AT-02: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.