Processor

frameworkGDPR sectionRequirements csf 2.0DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10 topicsVendor Risk Mgmt frameworks0 10 2

Official text · not licensableSee the official text of GDPR.

gap from GDPR → gap to GDPR →

Wrong or missing mapping? Report it

Equivalents of Art.28(3) in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	DE.CM-06 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10	External service provider activities and services are monitored to find potentially adverse events; Suppliers are known and prioritized by criticality…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
ISO 27001	A.5.19 A.5.20 A.5.22	Information security in supplier relationships; Addressing information security within supplier agreements…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) A.5.31 Legal, statutory, regulatory and contractual requirements Loosely related Only shares CSF GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.1 General Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping A.8.16 Monitoring activities Loosely related Only shares CSF DE.CM-06: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Loosely related Only shares CSF GV.SC-06: related, not a mapping
CIS v8.1	CIS 15.1 CIS 15.3 CIS 15.4 CIS 15.5 CIS 15.6 CIS 15.7	Establish and Maintain an Inventory of Service Providers; Classify Service Providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) CIS 15.2 Establish and Maintain a Service Provider Management Policy Loosely related Only shares CSF DE.CM-06: related, not a mapping
SOC 2	CC9.2	Managing vendor and business partner risk	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
PCI DSS	12.8.1 12.8.2 12.8.3 12.8.4 12.8.5	List of third-party service providers kept; Written agreements with service providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 11 loosely related (not mappings) 1.2.4 Accurate account-data flow diagram maintained Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Loosely related Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 6.3.2 Inventory of custom software and its components Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 1.2.3 Accurate network diagram maintained Loosely related Only shares CSF GV.SC-06: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.SC-07: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Loosely related Only shares CSF GV.SC-07: related, not a mapping 7.2.4 User accounts and privileges reviewed every six months Loosely related Only shares CSF DE.CM-06: related, not a mapping 10.2.1 Audit logs enabled and active Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 3 more in the downloads
CMMC	RA.L2-3.11.1 CA.L2-3.12.3 CM.L2-3.4.9 SI.L2-3.14.6	Risk Assessments; Security Control Monitoring…	Loosely related	No mapping. Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07, ID.RA-10…: related, not a mapping +1 more loosely related (not mappings) SI.L2-3.14.7 Identify Unauthorized Use Loosely related Only shares CSF DE.CM-06: related, not a mapping
800-53	SA-4 SA-9 SR-6	Acquisition Process; External System Services…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 6 loosely related (not mappings) RA-9 Criticality Analysis Loosely related Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping PS-7 External Personnel Security Loosely related Only shares CSF DE.CM-06: related, not a mapping SI-4 System Monitoring Loosely related Only shares CSF DE.CM-06: related, not a mapping SR-3 Supply Chain Controls and Processes Loosely related Only shares CSF GV.SC-07: related, not a mapping SR-5 Acquisition Strategies, Tools, and Methods Loosely related Only shares CSF GV.SC-06: related, not a mapping
HIPAA	§164.308(b)(1)§164.314(a)	Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 10 loosely related (not mappings) §164.308(b)(4) Written Contract or Other Arrangement Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Loosely related Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-06: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Loosely related Only shares CSF DE.CM-06: related, not a mapping …and 2 more in the downloads
NIS2	5.1 5.2 6.1	Supply chain security policy; Directory of suppliers and service providers…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick) 1 loosely related (not mappings) 13.1 Supporting utilities Loosely related Only shares CSF DE.CM-06, ID.RA-10: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3)	General principles; General principles…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
CPS 234	Para 16 Para 22 Para 28 Para 34	Assess third parties' information security capability; Evaluate the design of third parties' controls…	Editorial	Same topic: Vendor Risk Mgmt (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.