Identification

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter II: ICT risk management csf 2.0GV.OC-01 GV.OC-04 GV.OC-05 ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-05 ID.AM-07 ID.AM-08 topicsAsset Management, Business Environment, Data Classification frameworks0 13 0

Official textAs part of the ICT risk management framework referred to in Article 6(1), financial entities shall identify, classify and adequately document all ICT supported business functions, roles and responsibilities, the information assets and ICT assets supporting those functions, and their roles and dependencies in relation to ICT risk. Financial entities shall review as needed, and at least yearly, the adequacy of this classification and of any relevant documentation.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.8(1) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.OC-01 GV.OC-04 GV.OC-05 ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-05 ID.AM-07 ID.AM-08	The organizational mission is understood and informs cybersecurity risk management; Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated…	Editorial	Same topic: Business Environment, Asset Management, Data Classification (editorial pick)
ISO 27001	A.5.9 A.5.11 A.5.12 A.5.13 A.7.14 Clause 4.1 Clause 4.2	Inventory of information and other associated assets; Return of assets…	Editorial	Same topic: Asset Management, Data Classification, Business Environment (editorial pick) 12 loosely related (not mappings) A.5.8 Information security in project management Loosely related Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping A.5.3 Segregation of duties Loosely related Only shares CSF GV.OC-05: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.20 Addressing information security within supplier agreements Loosely related Only shares CSF GV.OC-04: related, not a mapping A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.OC-04: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.13 Equipment maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 4 more in the downloads
CIS v8.1	CIS 1.1 CIS 1.2 CIS 1.3 CIS 1.4 CIS 1.5 CIS 2.1 CIS 2.3 CIS 2.4 CIS 3.2 CIS 3.7 CIS 3.8 CIS 16.4	Establish and Maintain Detailed Enterprise Asset Inventory; Address Unauthorized Assets…	Editorial	Same topic: Asset Management, Data Classification (editorial pick) 2 loosely related (not mappings) CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 15.1 Establish and Maintain an Inventory of Service Providers Loosely related Only shares CSF ID.AM-04: related, not a mapping
SOC 2	C1.1 CC3.1 CC6.1	Identifying and protecting confidential information; Objectives specified clearly enough to identify risks…	Editorial	Same topic: Data Classification, Business Environment, Asset Management (editorial pick) 4 loosely related (not mappings) A1.1 Capacity management to meet availability commitments Loosely related Only shares CSF GV.OC-04: related, not a mapping A1.2 Environmental protections, backups and recovery infrastructure Loosely related Only shares CSF GV.OC-04: related, not a mapping CC9.1 Mitigating risks from business disruptions Loosely related Only shares CSF GV.OC-04: related, not a mapping CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF ID.AM-04: related, not a mapping
PCI DSS	6.3.2 9.4.2 12.5.1 12.5.2	Inventory of custom software and its components; Media classified by data sensitivity…	Editorial	Same topic: Asset Management, Data Classification, Business Environment (editorial pick) 29 loosely related (not mappings) 12.8.1 List of third-party service providers kept Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.OC-05, ID.AM-01: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping 11.6.1 Payment page changes and tampering detected Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping 12.8.4 Service provider compliance monitored annually Loosely related Only shares CSF GV.OC-05, ID.AM-04: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.OC-05: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Loosely related Only shares CSF ID.AM-07: related, not a mapping 3.4.1 PAN masked when displayed Loosely related Only shares CSF ID.AM-07: related, not a mapping …and 21 more in the downloads
CMMC	CM.L2-3.4.1 MP.L2-3.8.4	System Baselining; Media Markings	Editorial	Same topic: Asset Management, Data Classification (editorial pick) 6 loosely related (not mappings) AC.L2-3.1.20 External Connections Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	CM-8 PM-5 PM-11 RA-2 RA-9	System Component Inventory; System Inventory…	Editorial	Same topic: Asset Management, Business Environment, Data Classification (editorial pick) 26 loosely related (not mappings) SA-9 External System Services Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping AC-20 Use of External Systems Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.OC-04, GV.OC-05: related, not a mapping SI-12 Information Management and Retention Loosely related Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.OC-05, ID.AM-08: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-12 Information Location Loosely related Only shares CSF ID.AM-07: related, not a mapping …and 18 more in the downloads
HIPAA	§164.310(d)§164.310(d)(2)(iii)	Device and Media Controls; Accountability	Editorial	Same topic: Asset Management (editorial pick) 25 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF GV.OC-05, ID.AM-02, ID.AM-04: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping …and 17 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Editorial	Same topic: Asset Management (editorial pick) 2 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF ID.AM-04: related, not a mapping Art.32(1)(b) Security of processing Loosely related Only shares CSF GV.OC-04: related, not a mapping
NIS2	12.1 12.4	Asset classification; Asset inventory	Editorial	Same topic: Data Classification, Asset Management (editorial pick) 5 loosely related (not mappings) 4.1 Business continuity and disaster recovery plan Loosely related Only shares CSF GV.OC-04: related, not a mapping 5.1 Supply chain security policy Loosely related Only shares CSF GV.OC-05: related, not a mapping 5.2 Directory of suppliers and service providers Loosely related Only shares CSF GV.OC-05: related, not a mapping 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping 13.1 Supporting utilities Loosely related Only shares CSF GV.OC-05: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Editorial	Same topic: Asset Management (editorial pick)
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Editorial	Same topic: Asset Management, Data Classification (editorial pick)
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Asset Management (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.