DORA · Chapter II: ICT risk management
Art.8(7)
Identification
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0ID.RA-03 ID.RA-04 ID.RA-05 ID.RA-06
topicsRisk Assessment
frameworks0 10 3
Official textFinancial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-03ID.RA-04ID.RA-05ID.RA-06 | Internal and external threats to the organization are identified and recorded; Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded… | Editorial | Same topic: Risk Assessment (editorial pick) |
| ISO 27001 | Clause 6.1.2Clause 6.1.3 | Information security risk assessment; Information security risk treatment | Editorial | Same topic: Risk Assessment (editorial pick)4 loosely related (not mappings)A.5.22 Monitoring, review and change management of supplier services Only shares CSF ID.RA-03: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC3.2CC3.3CC3.4 | Risk identification and analysis; Considering the potential for fraud… | Editorial | Same topic: Risk Assessment (editorial pick) |
| PCI DSS | 12.3.1 | Targeted risk analysis for flexible-frequency requirements | Editorial | Same topic: Risk Assessment (editorial pick)6 loosely related (not mappings)6.3.3 Security patches installed promptly Only shares CSF ID.RA-05, ID.RA-06: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF ID.RA-06: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Only shares CSF ID.RA-05: related, not a mapping |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Editorial | Same topic: Risk Assessment (editorial pick)1 loosely related (not mappings) |
| 800-53 | RA-3RA-7 | Risk Assessment; Risk Response | Editorial | Same topic: Risk Assessment (editorial pick)10 loosely related (not mappings)…and 2 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A) | Risk Analysis | Editorial | Same topic: Risk Assessment (editorial pick)3 loosely related (not mappings)§164.308(a)(1)(ii)(B) Risk Management Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.316(a) Policies and Procedures Only shares CSF ID.RA-03, ID.RA-04, ID.RA-05: related, not a mapping §164.308(a)(7)(ii)(E) Applications and Data Criticality Analysis Only shares CSF ID.RA-04, ID.RA-05: related, not a mapping |
| GDPR | Art.35(1)Art.35(7) | Data protection impact assessment; Data protection impact assessment | Editorial | Same topic: Risk Assessment (editorial pick) |
| NIS2 | 2.1 | Risk management framework | Editorial | Same topic: Risk Assessment (editorial pick)1 loosely related (not mappings)6.10 Vulnerability handling and disclosure Only shares CSF ID.RA-04, ID.RA-05, ID.RA-06: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| CPS 234 | Para 17Para 21 | Keep capability current as threats and vulnerabilities change; Timely controls commensurate with risk and asset life-cycle | Editorial | Same topic: Risk Assessment (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.