DORA · Chapter II: ICT risk management
Art.6(5)
ICT risk management framework
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0GV.PO-01 GV.PO-02
topicsGovernance Policy
frameworks0 9 4
Official textThe ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.PO-01GV.PO-02 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Editorial | Same topic: Governance Policy (editorial pick) |
| ISO 27001 | A.5.1A.5.37Clause 5.2 | Policies for information security; Documented operating procedures… | Editorial | Same topic: Governance Policy (editorial pick) |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC1.1CC5.3 | Commitment to integrity and ethical values; Control activities deployed through policies and procedures | Editorial | Same topic: Governance Policy (editorial pick) |
| PCI DSS | 12.1.112.1.2 | Information security policy established and published; Security policy reviewed at least annually | Editorial | Same topic: Governance Policy (editorial pick)14 loosely related (not mappings)1.1.1 Network security policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 2.1.1 Secure configuration policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 3.1.1 Stored account data policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 4.1.1 Data-in-transit policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 5.1.1 Anti-malware policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 6.1.1 Secure systems and software policies documented Only shares CSF GV.PO-02: related, not a mapping 7.1.1 Access restriction policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 8.1.1 Identification and authentication policies documented Only shares CSF GV.PO-02: related, not a mapping …and 6 more in the downloads |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| 800-53 | PL-1PM-1 | Policy and Procedures; Information Security Program Plan | Editorial | Same topic: Governance Policy (editorial pick)18 loosely related (not mappings)…and 10 more in the downloads |
| HIPAA | §164.316(a)§164.316(b)(2)(iii) | Policies and Procedures; Updates | Editorial | Same topic: Governance Policy (editorial pick)21 loosely related (not mappings)§164.308(a)(1) Security Management Process Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4) Information Access Management Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping …and 13 more in the downloads |
| GDPR | Art.24(2) | Responsibility of the controller | Editorial | Same topic: Governance Policy (editorial pick) |
| NIS2 | 1.1 | Policy on the security of network and information systems | Editorial | Same topic: Governance Policy (editorial pick)1 loosely related (not mappings)6.1 Security in acquisition of ICT services, ICT systems or ICT products Only shares CSF GV.PO-02: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 18Para 19 | Maintain an information security policy framework; Policies direct everyone with security obligations | Editorial | Same topic: Governance Policy (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.