DORA · Chapter II: ICT risk management
Art.8(2)
Identification
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0DE.AE-07 ID.RA-01 ID.RA-02 ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06 ID.RA-08
topicsRisk Assessment, Vulnerability Mgmt, Threat Intelligence
frameworks0 13 0
Official textFinancial entities shall, on a continuous basis, identify all sources of ICT risk, in particular the risk exposure to and from other financial entities, and assess cyber threats and ICT vulnerabilities relevant to their ICT supported business functions, information assets and ICT assets. Financial entities shall review on a regular basis, and at least yearly, the risk scenarios impacting them.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.AE-07ID.RA-01ID.RA-02ID.RA-03ID.RA-04ID.RA-05ID.RA-06ID.RA-08 | Cyber threat intelligence and other contextual information are integrated into the analysis; Vulnerabilities in assets are identified, validated, and recorded… | Editorial | Same topic: Threat Intelligence, Vulnerability Mgmt, Risk Assessment (editorial pick) |
| ISO 27001 | A.5.7A.8.8Clause 6.1.2Clause 6.1.3 | Threat intelligence; Management of technical vulnerabilities… | Editorial | Same topic: Threat Intelligence, Vulnerability Mgmt, Risk Assessment (editorial pick)3 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-02, ID.RA-03: related, not a mapping |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| SOC 2 | CC3.2CC3.3CC3.4CC7.1 | Risk identification and analysis; Considering the potential for fraud… | Editorial | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick) |
| PCI DSS | 6.3.111.3.111.3.212.3.1 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Editorial | Same topic: Vulnerability Mgmt, Threat Intelligence, Risk Assessment (editorial pick)8 loosely related (not mappings)6.3.3 Security patches installed promptly Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF DE.AE-07: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Only shares CSF ID.RA-05: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF DE.AE-07: related, not a mapping |
| CMMC | RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3SI.L2-3.14.3 | Risk Assessments; Vulnerability Scan… | Editorial | Same topic: Risk Assessment, Vulnerability Mgmt, Threat Intelligence (editorial pick)5 loosely related (not mappings) |
| 800-53 | CA-8PM-15PM-16RA-3RA-5RA-7SI-5 | Penetration Testing; Security and Privacy Groups and Associations… | Editorial | Same topic: Vulnerability Mgmt, Threat Intelligence, Risk Assessment (editorial pick)14 loosely related (not mappings)…and 6 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management… | Editorial | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick)4 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF DE.AE-07, ID.RA-01, ID.RA-03, ID.RA-04…: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.RA-01: related, not a mapping |
| GDPR | Art.32(1)(d)Art.35(1)Art.35(7) | Security of processing; Data protection impact assessment… | Editorial | Same topic: Vulnerability Mgmt, Risk Assessment (editorial pick) |
| NIS2 | 2.16.56.10 | Risk management framework; Security testing… | Editorial | Same topic: Risk Assessment, Vulnerability Mgmt (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1698ISM-1699ISM-1701ISM-1702ISM-1807ISM-1808 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates…… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)23 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads |
| CPS 234 | Para 17Para 21Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle… | Editorial | Same topic: Risk Assessment, Vulnerability Mgmt, Threat Intelligence (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.