Identification

frameworkDORA (Regulation (EU) 2022/2554) sectionChapter II: ICT risk management csf 2.0ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08 topicsAsset Management frameworks0 13 0

Official textFor the purposes of paragraphs 1, 4 and 5, financial entities shall maintain relevant inventories and update them periodically and every time any major change as referred to in paragraph 3 occurs.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)

gap from DORA → gap to DORA →

Wrong or missing mapping? Report it

Equivalents of Art.8(6) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-08	Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained…	Editorial	Same topic: Asset Management (editorial pick)
ISO 27001	A.5.9 A.5.11 A.7.14	Inventory of information and other associated assets; Return of assets…	Editorial	Same topic: Asset Management (editorial pick) 7 loosely related (not mappings) A.5.22 Monitoring, review and change management of supplier services Loosely related Only shares CSF ID.AM-04, ID.AM-08: related, not a mapping A.5.8 Information security in project management Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.12 Classification of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.13 Labelling of information Loosely related Only shares CSF ID.AM-08: related, not a mapping A.5.19 Information security in supplier relationships Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.10 Storage media Loosely related Only shares CSF ID.AM-08: related, not a mapping A.7.13 Equipment maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping
CIS v8.1	CIS 1.1 CIS 1.2 CIS 1.3 CIS 1.4 CIS 1.5 CIS 2.1 CIS 2.3 CIS 2.4 CIS 16.4	Establish and Maintain Detailed Enterprise Asset Inventory; Address Unauthorized Assets…	Editorial	Same topic: Asset Management (editorial pick) 2 loosely related (not mappings) CIS 3.5 Securely Dispose of Data Loosely related Only shares CSF ID.AM-08: related, not a mapping CIS 15.1 Establish and Maintain an Inventory of Service Providers Loosely related Only shares CSF ID.AM-04: related, not a mapping
SOC 2	CC6.1	Logical access security over information assets	Editorial	Same topic: Asset Management (editorial pick) 1 loosely related (not mappings) CC9.2 Managing vendor and business partner risk Loosely related Only shares CSF ID.AM-04: related, not a mapping
PCI DSS	6.3.2 12.5.1	Inventory of custom software and its components; Inventory of in-scope system components	Editorial	Same topic: Asset Management (editorial pick) 17 loosely related (not mappings) 12.8.1 List of third-party service providers kept Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF ID.AM-01: related, not a mapping 6.2.1 Bespoke and custom software developed securely Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.2 Developers trained in secure software development Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3 Custom code reviewed before release Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.3.1 Manual code reviews approved by someone else Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.2.4 Coding techniques prevent common software attacks Loosely related Only shares CSF ID.AM-08: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
CMMC	CM.L2-3.4.1	System Baselining	Editorial	Same topic: Asset Management (editorial pick) 6 loosely related (not mappings) AC.L2-3.1.20 External Connections Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping AC.L2-3.1.21 Portable Storage Use Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CA.L2-3.12.4 System Security Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.1 Perform Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA.L2-3.7.3 Equipment Sanitization Loosely related Only shares CSF ID.AM-08: related, not a mapping SC.L2-3.13.2 Security Engineering Loosely related Only shares CSF ID.AM-08: related, not a mapping
800-53	CM-8 PM-5	System Component Inventory; System Inventory	Editorial	Same topic: Asset Management (editorial pick) 19 loosely related (not mappings) AC-20 Use of External Systems Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping SA-9 External System Services Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping CM-9 Configuration Management Plan Loosely related Only shares CSF ID.AM-08: related, not a mapping CM-13 Data Action Mapping Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-2 Controlled Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping MA-6 Timely Maintenance Loosely related Only shares CSF ID.AM-08: related, not a mapping PL-2 System Security and Privacy Plans Loosely related Only shares CSF ID.AM-08: related, not a mapping PM-22 Personally Identifiable Information Quality Management Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 11 more in the downloads
HIPAA	§164.310(d)§164.310(d)(2)(iii)	Device and Media Controls; Accountability	Editorial	Same topic: Asset Management (editorial pick) 17 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.308(a)(1)(ii)(B) Risk Management Loosely related Only shares CSF ID.AM-08: related, not a mapping …and 9 more in the downloads
GDPR	Art.30(1)	Records of processing activities	Editorial	Same topic: Asset Management (editorial pick) 1 loosely related (not mappings) Art.28(1) Processor Loosely related Only shares CSF ID.AM-04: related, not a mapping
NIS2	12.4	Asset inventory	Editorial	Same topic: Asset Management (editorial pick) 1 loosely related (not mappings) 6.2 Secure development life cycle Loosely related Only shares CSF ID.AM-08: related, not a mapping
Essential Eight	ISM-1807	An automated method of asset discovery is used at least fortnightly to support the…	Editorial	Same topic: Asset Management (editorial pick)
CPS 234	Para 20	Classify information assets by criticality and sensitivity	Editorial	Same topic: Asset Management (editorial pick)
Cyber Essentials	CE 3	Security Update Management	Editorial	Same topic: Asset Management (editorial pick) 1 loosely related (not mappings) CE 4 User Access Control Loosely related Only shares CSF ID.AM-04: related, not a mapping

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.