DORA · Chapter II: ICT risk management
Art.9(2)
Protection and prevention
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0PR.DS-01 PR.DS-02 PR.DS-10
topicsData Protection
frameworks0 11 1
Official textFinancial entities shall design, procure and implement ICT security policies, procedures, protocols and tools that aim to ensure the resilience, continuity and availability of ICT systems, in particular for those supporting critical or important functions, and to maintain high standards of availability, authenticity, integrity and confidentiality of data, whether at rest, in use or in transit.Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.DS-01PR.DS-02PR.DS-10 | The confidentiality, integrity, and availability of data-at-rest are protected; The confidentiality, integrity, and availability of data-in-transit are protected… | Editorial | Same topic: Data Protection (editorial pick) |
| ISO 27001 | A.5.14A.8.10A.8.11 | Information transfer; Information deletion… | Editorial | Same topic: Data Protection (editorial pick)30 loosely related (not mappings)A.5.10 Acceptable use of information and other associated assets Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.5.13 Labelling of information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.2 Terms and conditions of employment Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping A.6.5 Responsibilities after termination or change of employment Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 22 more in the downloads |
| CIS v8.1 | CIS 3.1CIS 3.4CIS 3.5CIS 3.11CIS 3.12 | Establish and Maintain a Data Management Process; Enforce Data Retention… | Editorial | Same topic: Data Protection (editorial pick)9 loosely related (not mappings)CIS 3.13 Deploy a Data Loss Prevention Solution Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CIS 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients Only shares CSF PR.DS-02: related, not a mapping CIS 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Only shares CSF PR.DS-02: related, not a mapping …and 1 more in the downloads |
| SOC 2 | C1.2CC6.5 | Disposing of confidential information; Protection of data when assets are disposed of | Editorial | Same topic: Data Protection (editorial pick)3 loosely related (not mappings)CC6.7 Restricting transmission, movement and removal of information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping CC6.1 Logical access security over information assets Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF PR.DS-02: related, not a mapping |
| PCI DSS | 3.2.13.3.13.4.1 | Account data storage minimised, with retention and disposal; Sensitive authentication data not kept after authorisation… | Editorial | Same topic: Data Protection (editorial pick)19 loosely related (not mappings)3.4.2 PAN copying prevented over remote-access technologies Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping 3.7.1 Key management: strong key generation Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 3.7.4 Key management: key changes at end of cryptoperiod Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 4.2.1.1 Inventory of trusted keys and certificates kept Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Only shares CSF PR.DS-01: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Only shares CSF PR.DS-01: related, not a mapping …and 11 more in the downloads |
| CMMC | MP.L2-3.8.3SC.L2-3.13.16 | Media Disposal; Data at Rest | Editorial | Same topic: Data Protection (editorial pick)24 loosely related (not mappings)SC.L2-3.13.1 Boundary Protection Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.2 Security Engineering Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.4 Shared Resource Control Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.5 Public-Access System Separation Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.2 Malicious Code Protection Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping SI.L2-3.14.4 Update Malicious Code Protection Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 16 more in the downloads |
| 800-53 | SC-8SC-28SI-7 | Transmission Confidentiality and Integrity; Protection of Information at Rest… | Editorial | Same topic: Data Protection (editorial pick)27 loosely related (not mappings)SC-4 Information in Shared System Resources Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 19 more in the downloads |
| HIPAA | §164.310(d)(2)(i)§164.312(c) | Disposal; Integrity | Editorial | Same topic: Data Protection (editorial pick)23 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(a)(2)(iv) Encryption and Decryption Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping §164.312(e)(2)(i) Integrity Controls Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping …and 15 more in the downloads |
| GDPR | Art.5(1)(e)Art.5(1)(f)Art.32(1)(b) | Principles relating to processing of personal data; Principles relating to processing of personal data… | Editorial | Same topic: Data Protection (editorial pick)2 loosely related (not mappings)Art.34(3)(a) Communication of a personal data breach to the data subject Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping |
| NIS2 | 12.212.3 | Handling of assets; Removable media policy | Editorial | Same topic: Data Protection (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1488 | Microsoft Office macros in files originating from the internet are blocked | No mapping. Only shares CSF PR.DS-02: related, not a mapping | |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | Same topic: Data Protection (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.