DORA · Chapter II: ICT risk management
Art.9(4)(c)
Protection and prevention
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0DE.CM-02 PR.AA-01 PR.AA-05 PR.AA-06 PR.IR-02
topicsAccess Control, Privileged Access, Physical Security
frameworks0 12 1
Official textimplement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only, and establish to that end a set of policies, procedures and controls that address access rights and ensure a sound administration thereof;Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-02PR.AA-01PR.AA-05PR.AA-06PR.IR-02 | The physical environment is monitored to find potentially adverse events; Identities and credentials for authorized users, services, and hardware are managed by the organization… | Editorial | Same topic: Physical Security, Access Control, Privileged Access (editorial pick) |
| ISO 27001 | A.5.15A.5.16A.5.18A.7.1A.7.2A.7.3A.7.4A.7.5A.7.6A.7.8A.7.11A.7.12A.8.2A.8.3A.8.18 | Access control; Identity management… | Editorial | Same topic: Access Control, Physical Security, Privileged Access (editorial pick)10 loosely related (not mappings)…and 2 more in the downloads |
| CIS v8.1 | CIS 3.3CIS 5.1CIS 5.2CIS 5.3CIS 5.4CIS 5.5CIS 5.6CIS 6.1CIS 6.2CIS 6.6CIS 6.7CIS 6.8CIS 12.5CIS 12.8 | Configure Data Access Control Lists; Establish and Maintain an Inventory of Accounts… | Editorial | Same topic: Access Control, Privileged Access (editorial pick)5 loosely related (not mappings)CIS 4.10 Enforce Automatic Device Lockout on Portable End-User Devices Only shares CSF PR.AA-05: related, not a mapping CIS 4.11 Enforce Remote Wipe Capability on Portable End-User Devices Only shares CSF PR.AA-05: related, not a mapping CIS 4.12 Separate Enterprise Workspaces on Mobile End-User Devices Only shares CSF PR.AA-05: related, not a mapping CIS 12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure Only shares CSF PR.AA-05: related, not a mapping |
| SOC 2 | CC6.1CC6.2CC6.3CC6.4 | Logical access security over information assets; User registration, authorization and removal… | Editorial | Same topic: Access Control, Privileged Access, Physical Security (editorial pick) |
| PCI DSS | 7.2.17.2.27.2.48.2.19.2.19.2.1.19.2.39.3.19.3.1.19.3.2 | Access control model defined; Access assigned by job function and least privilege… | Editorial | Same topic: Access Control, Privileged Access, Physical Security (editorial pick)20 loosely related (not mappings)9.5.1.2 POI devices inspected for tampering Only shares CSF DE.CM-02, PR.AA-06: related, not a mapping 3.6.1 Procedures protect keys that secure stored account data Only shares CSF PR.AA-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Only shares CSF PR.AA-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Only shares CSF PR.AA-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Only shares CSF PR.AA-01: related, not a mapping 3.6.1.4 Keys stored in the fewest possible locations Only shares CSF PR.AA-01: related, not a mapping 7.1.1 Access restriction policies documented and kept current Only shares CSF PR.AA-05: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF PR.AA-05: related, not a mapping …and 12 more in the downloads |
| CMMC | AC.L2-3.1.1AC.L2-3.1.2AC.L2-3.1.5AC.L2-3.1.6AC.L2-3.1.7PE.L2-3.10.1PE.L2-3.10.2PE.L2-3.10.3PE.L2-3.10.4PE.L2-3.10.5PE.L2-3.10.6 | Authorized Access Control; Transaction & Function Control… | Editorial | Same topic: Access Control, Privileged Access, Physical Security (editorial pick)27 loosely related (not mappings)…and 19 more in the downloads |
| 800-53 | AC-2AC-2(7)AC-3AC-6(5)PE-2PE-3PE-6PE-8PE-13PE-14 | Account Management; Privileged User Accounts… | Editorial | Same topic: Access Control, Privileged Access, Physical Security (editorial pick)34 loosely related (not mappings)AC-14 Permitted Actions Without Identification or Authentication Only shares CSF PR.AA-01: related, not a mapping …and 26 more in the downloads |
| HIPAA | §164.308(a)(4)§164.310(a)§164.310(a)(2)(ii)§164.310(a)(2)(iii)§164.310(b)§164.310(c)§164.312(a)§164.312(a)(2)(i)§164.312(d) | Information Access Management; Facility Access Controls… | Editorial | Same topic: Access Control, Physical Security (editorial pick)19 loosely related (not mappings)§164.310(a)(2)(i) Contingency Operations Only shares CSF DE.CM-02, PR.AA-06, PR.IR-02: related, not a mapping §164.310(d) Device and Media Controls Only shares CSF DE.CM-02, PR.AA-05, PR.AA-06: related, not a mapping §164.312(a)(2)(ii) Emergency Access Procedure Only shares CSF PR.AA-01, PR.AA-05, PR.IR-02: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF PR.AA-01, PR.AA-05: related, not a mapping …and 11 more in the downloads |
| GDPR | Art.25(2)Art.32(1)(b) | Data protection by design and by default; Security of processing | Editorial | Same topic: Access Control (editorial pick) |
| NIS2 | 11.111.211.311.411.513.113.213.3 | Access control policy; Management of access rights… | Editorial | Same topic: Access Control, Privileged Access, Physical Security (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-0445ISM-1175ISM-1380ISM-1387ISM-1507ISM-1508ISM-1647ISM-1648 | Privileged human users are assigned a dedicated privileged user account to be used…; Privileged user accounts (excluding those explicitly authorised to access online…… | Editorial | Same topic: Privileged Access (editorial pick)12 loosely related (not mappings)ISM-1509 Privileged access events are centrally logged Only shares CSF PR.AA-05: related, not a mapping ISM-1649 Just-in-time administration is used for the administration of systems and their resources Only shares CSF PR.AA-05: related, not a mapping ISM-1650 Privileged user account and security group management events are centrally logged Only shares CSF PR.AA-05: related, not a mapping ISM-1685 Credentials for break glass accounts, local administrator accounts and service accounts… Only shares CSF PR.AA-05: related, not a mapping ISM-1687 Privileged operating environments are not virtualised within unprivileged operating… Only shares CSF PR.AA-05: related, not a mapping ISM-1688 Unprivileged user accounts cannot be used to log on to privileged operating environments Only shares CSF PR.AA-05: related, not a mapping ISM-1689 Privileged user accounts (excluding local administrator accounts) cannot be used to log… Only shares CSF PR.AA-05: related, not a mapping …and 4 more in the downloads |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | CE 4 | User Access Control | Editorial | Same topic: Access Control, Privileged Access (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.