DORA · Chapter II: ICT risk management
Art.8(3)
Identification
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06
topicsRisk Assessment
frameworks0 10 3
Official textFinancial entities, other than microenterprises, shall perform a risk assessment upon each major change in the network and information system infrastructure, in the processes or procedures affecting their ICT supported business functions, information assets or ICT assets.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-03ID.RA-04ID.RA-05ID.RA-06 | Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded… | Editorial | Same topic: Risk Assessment (editorial pick) |
| ISO 27001 | Clause 6.1.2Clause 6.1.3 | Information security risk assessment; Information security risk treatment | Editorial | Same topic: Risk Assessment (editorial pick)4 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-03: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.2CC3.3CC3.4 | Risk identification and analysis; Considering the potential for fraud… | Editorial | Same topic: Risk Assessment (editorial pick) |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Editorial | Same topic: Risk Assessment (editorial pick)6 loosely related (not mappings)6.3.3 Security patches installed promptly Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF ID.RA-06: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Only shares CSF ID.RA-05: related, not a mapping |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Editorial | Same topic: Risk Assessment (editorial pick)1 loosely related (not mappings) |
| 800-53 | RA-3RA-7 | Risk Assessment; Risk Response | Editorial | Same topic: Risk Assessment (editorial pick)10 loosely related (not mappings)…and 2 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A) | Risk Analysis | Editorial | Same topic: Risk Assessment (editorial pick)3 loosely related (not mappings)§164.308(a)(1)(ii)(B) Risk Management Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.316(a) Policies and Procedures Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | Editorial | Same topic: Risk Assessment (editorial pick) |
| NIS2 | 2.1 | Risk management framework | Editorial | Same topic: Risk Assessment (editorial pick)1 loosely related (not mappings)6.10 Vulnerability handling and disclosure Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 17Para 21 | Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle | Editorial | Same topic: Risk Assessment (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.