DORA · Chapter II: ICT risk management
Art.6(6)
ICT risk management framework
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0GV.OC-03 GV.OV-03
topicsCompliance
frameworks0 10 3
Official textThe ICT risk management framework of financial entities, other than microenterprises, shall be subject to internal audit by auditors on a regular basis in line with the financial entities’ audit plan. Those auditors shall possess sufficient knowledge, skills and expertise in ICT risk, as well as appropriate independence. The frequency and focus of ICT audits shall be commensurate to the ICT risk of the financial entity.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-03GV.OV-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Editorial | Same topic: Compliance (editorial pick) |
| ISO 27001 | A.5.31A.5.36Clause 9.1 | Legal, statutory, regulatory and contractual requirements; Compliance with policies, rules and standards for information security… | Editorial | Same topic: Compliance (editorial pick)7 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.OV-03: related, not a mapping A.8.34 Protection of information systems during audit testing Only shares CSF GV.OV-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-03: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC4.1CC4.2 | Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies | Editorial | Same topic: Compliance (editorial pick) |
| PCI DSS | 12.4.2 | Service providers: quarterly reviews of operational tasks | Editorial | Same topic: Compliance (editorial pick)16 loosely related (not mappings)3.2.1 Account data storage minimised, with retention and disposal Only shares CSF GV.OC-03: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF GV.OV-03: related, not a mapping 9.4.6 Hard-copy media destroyed when no longer needed Only shares CSF GV.OC-03: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF GV.OC-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Only shares CSF GV.OV-03: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF GV.OV-03: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF GV.OV-03: related, not a mapping …and 8 more in the downloads |
| CMMC | CA.L2-3.12.1 | Security Control Assessment | Editorial | Same topic: Compliance (editorial pick)1 loosely related (not mappings) |
| 800-53 | CA-2PM-4PM-6 | Control Assessments; Plan of Action and Milestones Process… | Editorial | Same topic: Compliance (editorial pick) |
| HIPAA | §164.308(a)(8) | Evaluation | Editorial | Same topic: Compliance (editorial pick)22 loosely related (not mappings)§164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.OC-03: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF GV.OC-03: related, not a mapping …and 14 more in the downloads |
| GDPR | Art.5(2) | Principles relating to processing of personal data | Editorial | Same topic: Compliance (editorial pick) |
| NIS2 | 2.22.3 | Compliance monitoring; Independent review of information and network security | Editorial | Same topic: Compliance (editorial pick) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 32Para 33Para 34 | Internal audit reviews control design and effectiveness; Assurance provided by appropriately skilled personnel… | Editorial | Same topic: Compliance (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.