DORA · Chapter II: ICT risk management
Art.9(4)(d)
Protection and prevention
frameworkDORA (Regulation (EU) 2022/2554)
sectionChapter II: ICT risk management
csf 2.0PR.AA-03 PR.DS-01 PR.DS-02
topicsMulti-Factor Auth, Encryption
frameworks0 12 0
Official textimplement policies and protocols for strong authentication mechanisms, based on relevant standards and dedicated control systems, and protection measures of cryptographic keys whereby data is encrypted based on results of approved data classification and ICT risk assessment processes;Regulation (EU) 2022/2554 (DORA), Official Journal of the European Union. © European Union, https://eur-lex.europa.eu (reuse authorised with acknowledgement; only the Official Journal text is authentic)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AA-03PR.DS-01PR.DS-02 | Users, services, and hardware are authenticated; The confidentiality, integrity, and availability of data-at-rest are protected… | Editorial | Same topic: Multi-Factor Auth, Encryption (editorial pick) |
| ISO 27001 | A.8.5A.8.24 | Secure authentication; Use of cryptography | Editorial | Same topic: Multi-Factor Auth, Encryption (editorial pick)34 loosely related (not mappings)A.5.10 Acceptable use of information and other associated assets Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping A.6.5 Responsibilities after termination or change of employment Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 26 more in the downloads |
| CIS v8.1 | CIS 3.6CIS 3.9CIS 3.10CIS 3.11CIS 6.3CIS 6.4CIS 6.5 | Encrypt Data on End-User Devices; Encrypt Data on Removable Media… | Editorial | Same topic: Encryption, Multi-Factor Auth (editorial pick)14 loosely related (not mappings)CIS 3.1 Establish and Maintain a Data Management Process Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.12 Segment Data Processing and Storage Based on Sensitivity Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 3.13 Deploy a Data Loss Prevention Solution Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CIS 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients Only shares CSF PR.DS-02: related, not a mapping CIS 9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions Only shares CSF PR.DS-02: related, not a mapping …and 6 more in the downloads |
| SOC 2 | CC6.1CC6.7 | Logical access security over information assets; Restricting transmission, movement and removal of information | Editorial | Same topic: Multi-Factor Auth, Encryption (editorial pick)4 loosely related (not mappings)C1.2 Disposing of confidential information Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.5 Protection of data when assets are disposed of Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping CC6.6 Protection against threats from outside system boundaries Only shares CSF PR.AA-03: related, not a mapping CC6.8 Preventing or detecting unauthorized or malicious software Only shares CSF PR.DS-02: related, not a mapping |
| PCI DSS | 3.5.13.6.13.7.13.7.44.2.14.2.1.18.4.18.4.28.4.38.5.1 | PAN rendered unreadable wherever stored; Procedures protect keys that secure stored account data… | Editorial | Same topic: Encryption, Multi-Factor Auth (editorial pick)23 loosely related (not mappings)3.4.2 PAN copying prevented over remote-access technologies Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping 3.5.1.3 Disk encryption access managed separately from OS access Only shares CSF PR.AA-03, PR.DS-01: related, not a mapping 3.3.1 Sensitive authentication data not kept after authorisation Only shares CSF PR.DS-01: related, not a mapping 3.6.1.1 Service providers document their cryptographic architecture Only shares CSF PR.DS-01: related, not a mapping 3.6.1.2 Secret and private keys stored in approved forms Only shares CSF PR.DS-01: related, not a mapping 3.6.1.3 Cleartext key components accessible to fewest custodians Only shares CSF PR.DS-01: related, not a mapping …and 15 more in the downloads |
| CMMC | AC.L2-3.1.13AC.L2-3.1.19IA.L2-3.5.3MP.L2-3.8.6SC.L2-3.13.8SC.L2-3.13.10SC.L2-3.13.11SC.L2-3.13.16 | Remote Access Confidentiality; Encrypt CUI on Mobile… | Editorial | Same topic: Encryption, Multi-Factor Auth (editorial pick)22 loosely related (not mappings)SC.L2-3.13.5 Public-Access System Separation Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping SC.L2-3.13.6 Network Communication by Exception Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping SI.L2-3.14.4 Update Malicious Code Protection Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 14 more in the downloads |
| 800-53 | IA-2(1)IA-2(2)SC-8SC-12SC-13SC-28 | Multi-factor Authentication to Privileged Accounts; Multi-factor Authentication to Non-privileged Accounts… | Editorial | Same topic: Multi-Factor Auth, Encryption (editorial pick) |
| HIPAA | §164.312(a)(2)(iv)§164.312(e)(2)(ii) | Encryption and Decryption; Encryption | Editorial | Same topic: Encryption (editorial pick)17 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping §164.308(a)(4)(ii)(A) Isolating Health care Clearinghouse Function Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping §164.312(c)(2) Mechanism to Authenticate Electronic Protected Health Information Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping …and 9 more in the downloads |
| GDPR | Art.32(1)(a)Art.34(3)(a) | Security of processing; Communication of a personal data breach to the data subject | Editorial | Same topic: Encryption (editorial pick)3 loosely related (not mappings)Art.5(1)(e) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping Art.5(1)(f) Principles relating to processing of personal data Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping |
| NIS2 | 9.111.611.7 | Cryptography; Authentication… | Editorial | Same topic: Encryption, Multi-Factor Auth (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-0974ISM-1173ISM-1401ISM-1504ISM-1679ISM-1872 | Multi-factor authentication is used to authenticate unprivileged human users of systems; Multi-factor authentication is used to authenticate privileged human users of systems… | Editorial | Same topic: Multi-Factor Auth (editorial pick)11 loosely related (not mappings)ISM-1488 Microsoft Office macros in files originating from the internet are blocked Only shares CSF PR.DS-02: related, not a mapping ISM-1505 Multi-factor authentication is used to authenticate human users of data repositories Only shares CSF PR.AA-03: related, not a mapping ISM-1680 Multi-factor authentication (where available) is used to authenticate human users to… Only shares CSF PR.AA-03: related, not a mapping ISM-1681 Multi-factor authentication is used to authenticate customers to online customer… Only shares CSF PR.AA-03: related, not a mapping ISM-1682 Multi-factor authentication used for authenticating human users of systems is… Only shares CSF PR.AA-03: related, not a mapping ISM-1683 Successful and unsuccessful multi-factor authentication events are centrally logged Only shares CSF PR.AA-03: related, not a mapping ISM-1873 Multi-factor authentication used for authenticating customers of online customer services provides a… Only shares CSF PR.AA-03: related, not a mapping ISM-1874 Multi-factor authentication used for authenticating customers of online customer services is phishing-resistant Only shares CSF PR.AA-03: related, not a mapping …and 3 more in the downloads |
| CPS 234 | Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping. Only shares CSF PR.DS-01, PR.DS-02: related, not a mapping | |
| Cyber Essentials | CE 4 | User Access Control | Editorial | Same topic: Multi-Factor Auth (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.