DORA · Chapter II: ICT risk management
Art.6(4)
ICT risk management framework
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0GV.RR-01 GV.RR-02 GV.RR-03
topicsRoles & Responsibilities
frameworks0 9 3
Official textFinancial entities, other than microenterprises, shall assign the responsibility for managing and overseeing ICT risk to a control function and ensure an appropriate level of independence of such control function in order to avoid conflicts of interest. Financial entities shall ensure appropriate segregation and independence of ICT risk management functions, control functions, and internal audit functions, according to the three lines of defence model, or an internal risk management and control model.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RR-01GV.RR-02GV.RR-03 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| ISO 27001 | A.5.2A.5.4 | Information security roles and responsibilities; Management responsibilities | Editorial | Same topic: Roles & Responsibilities (editorial pick)4 loosely related (not mappings) |
| CIS v8.1 | CIS 14.1CIS 14.9 | Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training | No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| SOC 2 | CC1.2CC1.3CC1.5 | Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| PCI DSS | 12.1.312.1.4 | Security roles and responsibilities defined; Executive responsibility for information security assigned | Editorial | Same topic: Roles & Responsibilities (editorial pick)15 loosely related (not mappings)3.1.2 Roles for protecting stored account data assigned Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Only shares CSF GV.RR-01: related, not a mapping …and 7 more in the downloads |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| 800-53 | PM-2PM-29PS-9 | Information Security Program Leadership Role; Risk Management Program Leadership Roles… | Editorial | Same topic: Roles & Responsibilities (editorial pick)5 loosely related (not mappings) |
| HIPAA | §164.308(a)(2) | Assigned Security Responsibility | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| GDPR | Art.37(1)Art.39(1) | Designation of the data protection officer; Tasks of the data protection officer | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| NIS2 | 1.2 | Roles, responsibilities and authorities | Editorial | Same topic: Roles & Responsibilities (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 13Para 14 | Board ultimately responsible for information security; Define information security roles and responsibilities | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.