DORA · Chapter II: ICT risk management
Art.6(2)
ICT risk management framework
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0DE.CM-02 PR.AA-06 PR.IR-02
topicsPhysical Security
frameworks0 8 5
Official textThe ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-02PR.AA-06PR.IR-02 | The physical environment is monitored to find potentially adverse events; Physical access to assets is managed, monitored, and enforced commensurate with risk… | Editorial | Same topic: Physical Security (editorial pick) |
| ISO 27001 | A.7.1A.7.2A.7.3A.7.4A.7.5A.7.6A.7.8A.7.11A.7.12 | Physical security perimeters; Physical entry… | Editorial | Same topic: Physical Security (editorial pick) |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC6.4 | Physical access restrictions | Editorial | Same topic: Physical Security (editorial pick) |
| PCI DSS | 9.2.19.2.1.19.2.39.3.19.3.1.19.3.2 | Facility entry controls restrict CDE access; Access to sensitive areas monitored by camera or access control… | Editorial | Same topic: Physical Security (editorial pick)6 loosely related (not mappings)9.5.1.2 POI devices inspected for tampering Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping 9.1.1 Physical security policies documented and kept current Only shares CSF PR.IR-02: related, not a mapping 9.2.4 Consoles in sensitive areas locked when unattended Only shares CSF PR.AA-06: related, not a mapping 9.4.1.2 Security of offline backup location reviewed annually Only shares CSF DE.CM-02: related, not a mapping |
| CMMC | PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3PE.L2-3.10.4PE.L2-3.10.5PE.L2-3.10.6 | Limit Physical Access; Monitor Facility… | Editorial | Same topic: Physical Security (editorial pick)2 loosely related (not mappings) |
| 800-53 | PE-2PE-3PE-6PE-8PE-13PE-14 | Physical Access Authorizations; Physical Access Control… | Editorial | Same topic: Physical Security (editorial pick)13 loosely related (not mappings)…and 5 more in the downloads |
| HIPAA | §164.310(a)§164.310(a)(2)(ii)§164.310(a)(2)(iii)§164.310(b)§164.310(c) | Facility Access Controls; Facility Security Plan… | Editorial | Same topic: Physical Security (editorial pick)11 loosely related (not mappings)§164.310(a)(2)(i) Contingency Operations Only shares CSF DE.CM-02, PR.AA-06, PR.IR-02: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF DE.CM-02: related, not a mapping §164.308(a)(7)(ii)(C) Emergency Mode Operation Plan Only shares CSF PR.IR-02: related, not a mapping §164.308(a)(7)(ii)(D) Testing and Revision Procedure Only shares CSF PR.IR-02: related, not a mapping …and 3 more in the downloads |
| GDPR | — | No requirement | No mapping in our data | No mapping in our data (only GDPR's security articles are mapped, editorially). |
| NIS2 | 13.113.213.3 | Supporting utilities; Protection against physical and environmental threats… | Editorial | Same topic: Physical Security (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.