Digital Operational Resilience Act
What is DORA?
Digital Operational Resilience Act (DORA)
The Digital Operational Resilience Act (DORA) is a EU regulation that entered into force on 16 January 2023 and will apply as of 17 January 2025.
It aims at strengthening the IT security of financial entities such as banks, insurance companies and investment firms and making sure that the financial sector in Europe is able to stay resilient in the event of a severe operational disruption.
DORA brings harmonisation of the rules relating to operational resilience for the financial sector applying to 20 different types of financial entities and ICT third-party service providers. Digital version of DORA can be found here: https://www.dora-info.eu/dora/.
Compliance consideration
DORA Mapping to ISO 27001 & NIST SP 800-53
1. ICT risk management: Chapter II (Articles 5 -16)
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Internal governance and control framework | A.5.1 – Policies for information security | NIST SP 800-53: PM-1, PM-9 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Â | A.5.4 – Management responsibilities | NIST SP 800-53: PM-1, PM-3 |
| Management body responsibilities | A.5.1 – Policies for information security | NIST SP 800-53: PM-1, PM-4 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Â | A.5.3 – Segregation of duties | NIST SP 800-53: AC-5, AC-6 |
| Â | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.8 – Information security in project management | NIST SP 800-53: PL-2, PM-8 |
| Policies for data protection | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.5.12 – Classification of information | NIST SP 800-53: MP-4, MP-5 |
| Â | A.5.15 – Access control | NIST SP 800-53: AC-3, AC-6 |
| Â | A.5.18 – Access rights | NIST SP 800-53: AC-2, AC-3 |
| Roles and responsibilities | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Â | A.5.3 – Segregation of duties | NIST SP 800-53: AC-5, AC-6 |
| Digital operational resilience strategy | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Business continuity policy | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Â | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| ICT internal audit plans | A.9.2 – Internal audit | NIST SP 800-53: CA-2, CA-5 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Appropriate budget allocation | A.7.4 – Physical security monitoring | NIST SP 800-53: PE-6, PE-20 |
| Â | A.7.5 – Protecting against physical and environmental threats | NIST SP 800-53: PE-10, PE-12 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Policy on ICT third-party service providers | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Reporting channels for ICT third-party service providers | A.5.22 – Monitoring, review and change management of supplier services | NIST SP 800-53: SA-9, SA-12 |
| Role for monitoring ICT third-party service providers | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Knowledge and skills for management body | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: AT-2, AT-3 |
| Â | A.6.3 – Information security awareness, education and training | NIST SP 800-53: AT-2, AT-3 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| ICT Risk Management Framework | A.5.1 – Policies for information security | NIST SP 800-53: PM-1, PM-9 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Â | A.5.8 – Information security in project management | NIST SP 800-53: PL-2, PM-8 |
| Â | A.8.1 – User end point devices | NIST SP 800-53: AC-19, AC-20 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.8.25 – Secure development life cycle | NIST SP 800-53: SA-8, SA-15 |
| Â | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-7, SI-6 |
| Strategies, policies, procedures, ICT protocols and tools | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.5.12 – Classification of information | NIST SP 800-53: MP-4, MP-5 |
| Â | A.5.15 – Access control | NIST SP 800-53: AC-3, AC-6 |
| Â | A.7.1 – Physical security perimeters | NIST SP 800-53: PE-2, PE-3 |
| Minimize the impact of ICT risk | A.5.24 – Information security incident management planning and preparation | NIST SP 800-53: IR-1, IR-4 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Assign responsibility for ICT risk | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: PM-1, PM-2 |
| Â | A.5.3 – Segregation of duties | NIST SP 800-53: AC-5, AC-6 |
| Document and review framework | A.5.1 – Policies for information security | NIST SP 800-53: PM-1, PM-4 |
| Â | A.9.2 – Internal audit | NIST SP 800-53: CA-2, CA-5 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Internal audit of ICT framework | A.9.2 – Internal audit | NIST SP 800-53: CA-2, CA-5 |
| Follow-up process for ICT audits | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: PM-1, PM-4 |
| Â | A.9.2 – Internal audit | NIST SP 800-53: CA-2, CA-5 |
| Digital operational resilience strategy | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.24 – Information security incident management planning and preparation | NIST SP 800-53: IR-1, IR-4 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Communication strategy | A.7.4 – Physical security monitoring | NIST SP 800-53: PE-6, PE-20 |
| Â | A.7.5 – Protecting against physical and environmental threats | NIST SP 800-53: PE-10, PE-12 |
| ICT multi-vendor strategy | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Outsourcing compliance verification | A.5.23 – Information security for use of cloud services | NIST SP 800-53: SA-9, SA-12 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Appropriate to the magnitude of operations | A.5.1 – Policies for information security | NIST SP 800-53: PM-1, PM-4 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Reliable | A.8.2 – Privileged access rights | NIST SP 800-53: AC-5, AC-6 |
| Â | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Â | A.8.7 – Protection against malware | NIST SP 800-53: SI-3 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Equipped with sufficient capacity | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.8.17 – Clock synchronization | NIST SP 800-53: AU-8 |
| Technologically resilient | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Identify and classify ICT supported business functions | A.5.9 – Inventory of information and other associated assets | NIST SP 800-53: CM-8, CM-12 |
| Â | A.5.12 – Classification of information | NIST SP 800-53: MP-4, MP-5 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Identify all sources of ICT risk | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Perform risk assessment upon major changes | A.5.9 – Inventory of information and other associated assets | NIST SP 800-53: CM-8, CM-12 |
| Â | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Identify and map all information and ICT assets | A.5.9 – Inventory of information and other associated assets | NIST SP 800-53: CM-8, CM-12 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.8.1 – User end point devices | NIST SP 800-53: AC-19, AC-20 |
| Identify processes dependent on ICT third-party service providers | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.22 – Monitoring, review and change management of supplier services | NIST SP 800-53: SA-9, SA-12 |
| Maintain inventories and update them periodically | A.5.9 – Inventory of information and other associated assets | NIST SP 800-53: CM-8, CM-12 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Conduct ICT risk assessment on legacy systems | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Monitor and control the security and functioning of ICT systems | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Design, procure and implement ICT security policies and tools | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Ensure the security of data transfer and protect against data risks | A.8.1 – User end point devices | NIST SP 800-53: AC-19, AC-20 |
| Â | A.8.23 – Web filtering | NIST SP 800-53: SC-7, SC-18 |
| Â | A.8.24 – Use of cryptography | NIST SP 800-53: SC-12, SC-13 |
| Â | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Â | A.8.7 – Protection against malware | NIST SP 800-53: SI-3 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Develop and document an information security policy | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Establish a sound network and infrastructure management structure | A.8.2 – Privileged access rights | NIST SP 800-53: AC-5, AC-6 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Limit physical or logical access to information assets | A.5.15 – Access control | NIST SP 800-53: AC-3, AC-6 |
| Â | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Implement policies and protocols for strong authentication mechanisms | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Â | A.8.24 – Use of cryptography | NIST SP 800-53: SC-12, SC-13 |
| Implement documented policies, procedures and controls for ICT change management | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.8.18 – Use of privileged utility programs | NIST SP 800-53: CM-5 |
| Â | A.8.32 – Change management | NIST SP 800-53: CM-4 |
| Documented policies for patches and updates | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Mechanisms to detect anomalous activities | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Regular testing of detection mechanisms | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Multiple layers of control, alert thresholds, and incident response | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Resources and capabilities to monitor user activity and ICT anomalies | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Systems for data reporting service providers to check trade reports | A.5.9 – Inventory of information and other associated assets | NIST SP 800-53: CM-8, CM-12 |
| Â | A.5.12 – Classification of information | NIST SP 800-53: MP-4, MP-5 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| ICT business continuity policy | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Â | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| Implement ICT business continuity policy | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Estimate impacts, damages and losses | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| Communication and crisis management actions | A.6.1 – Screening | NIST SP 800-53: CA-3, IR-4 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| ICT response and recovery plans | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Test ICT business continuity plans | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Conduct business impact analysis (BIA) | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: RA-3, CP-2 |
| Test ICT business continuity and response plans | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Crisis management function | A.6.1 – Screening | NIST SP 800-53: CA-3, IR-4 |
| Keep records of activities during disruption events | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Provide copies of ICT business continuity tests results | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Report aggregated annual costs and losses | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Develop and document backup policies and procedures | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Set up and test backup systems | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Use physically and logically segregated systems for restoring backup data | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Maintain redundant ICT capacities | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Secondary processing site for central securities depositories | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.6 – Capacity management | NIST SP 800-53: CP-2, CP-7 |
| Determine recovery time and recovery point objectives | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: RA-3 |
| Perform checks to ensure data integrity when recovering from an ICT-related incident | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Gather information on vulnerabilities and cyber threats | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: RA-3, IR-4 |
| Post ICT-related incident reviews | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Incorporate lessons from testing and real incidents | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: RA-3, IR-4 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Monitor the effectiveness of the digital operational resilience strategy | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Report findings and recommendations to the management body | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Develop ICT security awareness programmes and training | A.6.3 – Information security awareness, education and training | NIST SP 800-53: AT-2, AT-3 |
| Monitor relevant technological developments | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: RA-3, IR-4 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Crisis communication plans for responsible disclosure | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Implement communication policies for internal staff and external stakeholders | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Designate a person responsible for communication strategy | A.5.4 – Management responsibilities | NIST SP 800-53: PM-1, PM-3 |
| Â | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Specify elements for ICT security policies, procedures, protocols, and tools | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.8.24 – Use of cryptography | NIST SP 800-53: SC-12, SC-13 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Develop further components of access management rights | A.5.15 – Access control | NIST SP 800-53: AC-3, AC-6 |
| Â | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Develop mechanisms for prompt detection of anomalous activities | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Specify components of ICT business continuity policy | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Â | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| Specify further testing of ICT business continuity plans | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Specify components of ICT response and recovery plans | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Specify content and format of the report on the review of ICT risk management framework | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Â | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Documented ICT risk management framework | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Continuous monitoring of ICT systems | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Minimise ICT risk through resilient systems | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Â | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Â | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Identify and detect sources of ICT risk and anomalies | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Identify dependencies on ICT third-party service providers | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Ensure continuity of critical functions through business continuity plans | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Â | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| Â | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
| Test plans and measures regularly | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Implement operational conclusions from tests and post-incident analysis | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Develop ICT security awareness programmes and training | A.6.3 – Information security awareness, education and training | NIST SP 800-53: AT-2, AT-3 |
| Document and review ICT risk management framework periodically | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Â | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Specify further elements for ICT risk management framework | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Specify further elements for systems, protocols, and tools | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Specify further components of ICT business continuity plans | A.5.29 – Information security during disruption | NIST SP 800-53: CP-1, CP-2 |
| Â | A.5.30 – ICT readiness for business continuity | NIST SP 800-53: CP-8 |
| Specify further rules on testing business continuity plans | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Specify content and format of the report on the review of ICT risk management framework | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Â | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
2. ICT-related incident management, classification and reporting: Chapter III (Articles 17- 23)
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Define, establish, and implement ICT-related incident management process | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Record all ICT-related incidents and significant cyber threats | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Put in place early warning indicators | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Identify, track, log, categorize, and classify ICT-related incidents | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Assign roles and responsibilities for incident types and scenarios | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Communication plans for staff, stakeholders, and media | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Report major ICT-related incidents to senior management | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Incident response procedures to mitigate impacts | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Classify ICT-related incidents based on specific criteria | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Classify cyber threats based on the criticality of services at risk | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Develop common draft regulatory technical standards for classification | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Specify criteria for assessing relevance of major incidents to other Member States | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Specify criteria for determining significant cyber threats | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Report major ICT-related incidents to relevant competent authority | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Voluntary notification of significant cyber threats | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Inform clients about major ICT-related incidents | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Submit initial notification, intermediate reports, and final report to competent authority | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Outsource reporting obligations | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Provide details of major ICT-related incidents to relevant recipients | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Assess and notify relevance of major ICT-related incidents to other Member States | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Transmission of details of major ICT-related incidents to relevant authorities | A.5.5 – Contact with authorities | NIST SP 800-53: CA-1, CA-6 |
| Â | A.5.6 – Contact with special interest groups | NIST SP 800-53: CA-1, CA-6 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Establish content of reports for major ICT-related incidents | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Determine time limits for initial notification and reports | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Establish content of notification for significant cyber threats | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Develop standard forms, templates, and procedures for reporting | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Assess feasibility of centralised incident reporting | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Prerequisites for a single EU Hub | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Benefits, limitations, and risks, including risks associated with high concentration of sensitive information | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: RA-3 |
| Â | A.8.14 – Redundancy of information processing facilities | NIST SP 800-53: CP-8 |
| Capability to ensure interoperability with other relevant reporting schemes | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Â | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Elements of operational management | A.5.4 – Management responsibilities | NIST SP 800-53: PM-1, PM-3 |
| Conditions of membership | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Technical arrangements for access to the single EU Hub | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Preliminary assessment of financial costs for the operational platform | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Acknowledge receipt of incident reports and provide feedback | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Provide anonymised information and intelligence on similar threats | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Report yearly on major ICT-related incidents | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Issue warnings and produce high-level statistics | A.5.7 – Threat intelligence | NIST SP 800-53: SI-5, PM-16 |
| Â | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Operational or security payment-related incidents | A.5.25 – Assessment and decision on information security events | NIST SP 800-53: IR-4, RA-3 |
| Â | A.5.26 – Response to information security incidents | NIST SP 800-53: IR-5, IR-6 |
| Â | A.8.16 – Monitoring activities | NIST SP 800-53: CA-7, SI-4 |
| Major operational or security payment-related incidents | A.8.15 – Logging | NIST SP 800-53: AU-2, AU-3 |
| Â | A.8.24 – Use of cryptography | NIST SP 800-53: SC-12, SC-13 |
| Â | A.8.13 – Information backup | NIST SP 800-53: CP-9 |
3. Digital operational resilience testing: Chapter IV (Articles 24 – 27))
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Establish, maintain, and review a digital operational resilience testing programme | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Include a range of assessments, tests, methodologies, practices, and tools | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Follow a risk-based approach for testing | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Ensure tests are undertaken by independent parties | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Establish procedures and policies to address issues revealed in tests | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Conduct yearly tests on all ICT systems and applications supporting critical functions | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Execute appropriate tests, such as vulnerability assessments and scans, network security assessments, etc. | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.8.5 – Secure authentication | NIST SP 800-53: IA-2, IA-5 |
| Perform vulnerability assessments before deployment or redeployment | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Microenterprises perform tests combining risk-based approach with strategic planning | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Â | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| DORAÂ Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Carry out advanced testing by means of TLPT every 3 years | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.27 – Learning from information security incidents | NIST SP 800-53: IR-4, IR-5 |
| Cover critical or important functions and perform on live production systems | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Include ICT third-party service providers in TLPT scope | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Conduct pooled testing with ICT third-party service providers if necessary | A.5.19 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.5.21 – Managing information security in the information and communication technology (ICT) supply chain | NIST SP 800-53: SA-9, SA-12 |
| Apply risk management controls to mitigate risks during TLPT | A.8.8 – Management of technical vulnerabilities | NIST SP 800-53: RA-5 |
| Â | A.8.9 – Configuration management | NIST SP 800-53: CM-2, CM-3 |
| Provide summary of findings and remediation plans to authorities | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Obtain attestation of TLPT compliance from authorities | A.9.2 – Internal audit | NIST SP 800-53: CA-2, CA-7 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Contract testers for TLPT and ensure compliance with Article 27 | A.8.29 – Security testing in development and acceptance | NIST SP 800-53: CA-2, CA-7 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Designate or delegate authority for TLPT-related matters | A.5.4 – Management responsibilities | NIST SP 800-53: PM-1, PM-3 |
| Develop joint regulatory technical standards in accordance with TIBER-EU | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Use testers of highest suitability and reputability | A.6.1 – Screening | NIST SP 800-53: PS-3, PS-6 |
| Testers possess technical and organisational capabilities | A.6.3 – Information security awareness, education and training | NIST SP 800-53: AT-2, AT-3 |
| Testers are certified or adhere to formal codes of conduct | A.9.2 – Internal audit | NIST SP 800-53: CA-2, CA-7 |
| Testers provide independent assurance or audit report | A.9.3 – Management review | NIST SP 800-53: CA-7, PM-6 |
| Testers are covered by professional indemnity insurances | A.6.6 – Confidentiality or non-disclosure agreements | NIST SP 800-53: SA-2, SA-12 |
| Conditions for using internal testers | A.6.1 – Screening | NIST SP 800-53: PS-3, PS-6 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Contracts with external testers ensure sound management of TLPT results | A.5.1 – Policies for information security | NIST SP 800-53: PL-1, PL-2 |
| Â | A.8.3 – Information access restriction | NIST SP 800-53: AC-3, AC-4 |
4. Managing of ICT third-party risk: Chapter V (Articles 28 -44)
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Responsibility and Compliance | A.15.1.1 – Information security policy for supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Proportionality Principle | A.6.1.1 – Information security roles and responsibilities | NIST SP 800-53: PM-1, PM-9 |
| Strategy and Policy | A.15.1.2 – Addressing security within supplier agreements | NIST SP 800-53: SA-9, SA-12 |
| Register of Information | A.8.1.1 – Inventory of assets | NIST SP 800-53: CM-8 |
| Pre-Contractual Assessment | A.15.2.1 – Monitoring and review of supplier services | NIST SP 800-53: SA-9, SA-12 |
| Information Security Standards | A.14.2.1 – Secure development policy | NIST SP 800-53: SA-8, SA-11 |
| Audit and Inspection Rights | A.18.2.3 – Technical compliance review | NIST SP 800-53: CA-7, SA-12 |
| Termination and Exit Strategies | A.15.2.2 – Managing changes to supplier services | NIST SP 800-53: SA-12, CA-7 |
| Reporting and Templates | A.15.1.3 – Information and communication technology supply chain | NIST SP 800-53: SR-5 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Assessment of substitutability and multiple arrangements | A.15.1 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.15.1.1 – Information security policy for supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.15.1.2 – Addressing security within supplier agreements | NIST SP 800-53: SA-9, SA-12 |
| Risks associated with subcontracting, especially in third countries | A.15.2 – Supply chain management | NIST SP 800-53: SA-12, SR-5 |
| Â | A.15.2.1 – Monitoring and review of supplier services | NIST SP 800-53: SA-12, SA-13 |
| Insolvency considerations and urgent data recovery | A.18.1 – Compliance with legal and contractual requirements | NIST SP 800-53: MP-5, MP-6 |
| Â | A.18.1.4 – Privacy and protection of personally identifiable information | NIST SP 800-53: MP-4, MP-5 |
| Compliance with Union data protection rules | A.18.1.4 – Privacy and protection of personally identifiable information | NIST SP 800-53: PM-24, IP-1 |
| Impact of long or complex chains of subcontracting | A.15.1.3 – Information and communication technology supply chain | NIST SP 800-53: SA-9, SA-12 |
| Â | A.12.1 – Operational procedures and responsibilities | NIST SP 800-53: CM-4, CM-8 |
| Â | A.12.4 – Logging and monitoring | NIST SP 800-53: AU-6, AU-12 |
| DORA Requirements | ISO/IEC 27001:2022 Control | Other Security Framework Controls |
| Rights and obligations | A.5.1 – Policies for information security | NIST SP 800-53: PM-1, PM-9 |
| Â | A.5.2 – Information security roles and responsibilities | NIST SP 800-53: CA-1, CA-2 |
| Â | A.5.4 – Management responsibilities | NIST SP 800-53: PM-1, PM-3 |
| Contractual arrangements: | Â | Â |
| (a) Description of functions and ICT services | A.15.1 – Information security in supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.15.1.1 – Information security policy for supplier relationships | NIST SP 800-53: SA-9, SA-12 |
| Â | A.15.1.2 – Addressing security within supplier agreements | NIST SP 800-53: SA-9, SA-12 |
| (b) Locations of services and data processing | A.15.2 – Supply chain management | NIST SP 800-53: SA-12, SR-5 |
| (c) Data protection provisions | A.18.1 – Compliance with legal and contractual requirements | NIST SP 800-53: MP-5, MP-6 |
| Â | A.8.2 – Information classification | NIST SP 800-53: RA-2, MP-4 |
| Â | A.8.3 – Media handling | NIST SP 800-53: MP-4, MP-5 |
| (d) Access, recovery, and return of data | A.8.13 – Information backup | NIST SP 800-53: CP-9, CP-10 |
| (e) Service level descriptions | A.15.2.1 – Monitoring and review of supplier services | NIST SP 800-53: SA-12, SA-13 |
| (f) Assistance in the event of ICT incidents | A.16.1 – Management of information security incidents and improvements | NIST SP 800-53: IR-4, IR-5 |
| (g) Cooperation with authorities | A.18.1.4 – Privacy and protection of personally identifiable information | NIST SP 800-53: PM-24, IP-1 |
| (h) Termination rights and notice periods | A.15.2.2 – Managing changes to supplier services | NIST SP 800-53: SA-12, SA-13 |
| (i) ICT security awareness programs | A.7.2 – Information security awareness, education, and training | NIST SP 800-53: AT-2, AT-3 |
| Additional provisions for critical functions: | Â | Â |
| (a) Full service level descriptions | A.15.1.3 – Information and communication technology supply chain | NIST SP 800-53: SA-9, SA-12 |
| (b) Notice periods and reporting obligations | A.12.4 – Logging and monitoring | NIST SP 800-53: AU-6, AU-12 |
| (c) Business contingency plans and security measures | A.17.1 – Information security continuity | NIST SP 800-53: CP-2, CP-4, CP-7 |
| (d) Participation in TLPT | A.18.2 – Information security reviews | NIST SP 800-53: CA-2, CA-7 |
| (e) Monitoring and audit rights | A.15.2.1 – Monitoring and review of supplier services | NIST SP 800-53: SA-12, SA-13 |
| (f) Exit strategies and transition periods | A.18.1.3 – Protection of records | NIST SP 800-53: CP-10, CP-11 |
| Use of standard contractual clauses | A.15.1.1 – Information security policy for supplier relationships | NIST SP 800-53: SA-12, SA-13 |
| Development of regulatory technical standards | A.18.1.4 – Privacy and protection of personally identifiable information | NIST SP 800-53: PM-24, IP-1 |
Article 31 (Designation of Critical ICT Third-Party Service Providers) primarily outlines the procedures and criteria for designating ICT third-party service providers as critical, the responsibilities of the ESAs and the Lead Overseer, and the conditions for financial entities’ use of services from these providers. It focuses on the regulatory and administrative processes rather than imposing direct operational compliance requirements on financial entities or third-party service providers. Therefore, detailed control mappings to ISO/IEC 27001:2022 or other security frameworks may not be directly relevant or useful for this article, similar to Article 32.
Key Points of Article 31:
- Designation of Critical ICT Third-Party Service Providers: The ESAs, through the Joint Committee and upon recommendation from the Oversight Forum, designate ICT third-party service providers that are critical for financial entities based on specific criteria.
- Appointment of Lead Overseer: The Lead Overseer is appointed to conduct the oversight of designated critical ICT third-party service providers.
- Assessment Criteria: Designation is based on criteria such as the systemic impact on financial services, the importance of financial entities relying on the provider, reliance on critical functions, and the degree of substitutability of the provider.
- Notification and Appeals: Procedures for notifying ICT third-party service providers of their designation as critical, and the process for submitting reasoned statements or additional information.
- Publication and Updates: The ESAs, through the Joint Committee, will publish and update a yearly list of critical ICT third-party service providers.
- Third-Country Providers: Conditions for using services from critical ICT third-party service providers established in third countries, including the requirement to establish a subsidiary in the Union within 12 months.
Since Article 31 deals with the designation process and regulatory oversight of critical ICT third-party service providers, it does not impose specific operational controls on financial entities or the ICT third-party service providers. Instead, it outlines the criteria and administrative processes for designation and oversight. Therefore, direct control mappings to ISO/IEC 27001:2022 or other security frameworks are not necessary for this article.
Article 32 (Structure of the Oversight Framework) primarily outlines the establishment, composition, and tasks of the Oversight Forum and the Lead Overseer. This article focuses on the organizational and procedural aspects of the oversight framework rather than setting direct compliance requirements for financial entities or third-party service providers. Therefore, it does not necessitate the same type of control mappings to ISO/IEC 27001:2022 or other security frameworks as other articles that impose specific operational requirements on financial entities and third-party service providers.
Key Points of Article 32:
- Establishment of the Oversight Forum: This forum is a sub-committee under the Joint Committee to support ICT third-party risk oversight.
- Annual Assessment and Coordination: The forum undertakes yearly assessments of oversight activities and promotes coordination to enhance digital operational resilience.
- Submission of Benchmarks: The forum submits benchmarks for critical ICT third-party service providers to be adopted by the Joint Committee.
- Composition of the Forum: Includes representatives from ESAs, national competent authorities, the Commission, ESRB, ECB, and ENISA.
- Appointment of Independent Experts: Experts are appointed based on their expertise and are required to act independently.
- Publication of Representatives: The ESAs will publish a list of high-level representatives.
- Guidelines on Cooperation: ESAs will issue guidelines on cooperation and information exchange between ESAs and competent authorities.
- Non-prejudice to Other Union Rules: The requirements do not prejudice the application of other Union rules on cloud computing service providers.
- Annual Report: The ESAs, through the Joint Committee, will submit an annual report on the application of this section to the European Parliament, Council, and Commission.
Since Article 32 deals with the oversight structure and responsibilities, it doesn’t impose direct operational or compliance requirements on financial entities or ICT third-party service providers that would necessitate control mappings. The focus here is on ensuring a robust and coordinated oversight mechanism across the financial sector.
Article 33 of the DORA regulation primarily focuses on the responsibilities and tasks of the Lead Overseer in the oversight of critical ICT third-party service providers. However, it does indirectly relate to the compliance of the third-party service providers and the financial entities that use their services in several ways:
Oversight and Assessment: The Lead Overseer is tasked with assessing whether critical ICT third-party service providers have comprehensive, sound, and effective rules, procedures, mechanisms, and arrangements to manage ICT risks. This assessment directly impacts the compliance requirements for third-party service providers, as they must adhere to the standards and expectations set by the Lead Overseer.
Requirements for Service Providers: The Lead Overseer assesses various aspects of the third-party service provider’s operations, including ICT security, physical security, risk management processes, governance arrangements, incident management, data portability, testing, and ICT audits. Third-party service providers must comply with these requirements to meet the standards set by the Lead Overseer.
Communication and Coordination: The oversight plan created by the Lead Overseer, based on their assessment, includes annual oversight objectives and actions. Third-party service providers are required to cooperate with the Lead Overseer and comply with the oversight plan, which includes providing necessary information and addressing any identified issues.
Compliance Reporting: Financial entities that use services from critical ICT third-party service providers must ensure that their providers comply with the requirements set forth by the Lead Overseer. This means that financial entities are responsible for selecting compliant third-party service providers and ensuring that they meet the necessary standards and regulations.
Article 34 primarily focuses on the coordination and operational procedures among Lead Overseers to ensure a consistent approach to oversight activities. The main points are:
Coordination Among Lead Overseers: The article mandates the creation of a Joint Oversight Network (JON) to coordinate oversight activities among the three Lead Overseers. This coordination is meant to ensure a consistent approach to the oversight of critical ICT third-party service providers.
Common Oversight Protocol: The Lead Overseers are required to develop a common oversight protocol, which outlines detailed procedures for day-to-day coordination and swift exchanges of information and responses. This protocol is to be periodically revised to meet operational needs.
Ad-hoc Technical Advice: The Lead Overseers can call on the European Central Bank (ECB) and the European Union Agency for Cybersecurity (ENISA) for technical advice and experience sharing, and to participate in specific coordination meetings of the JON.
Article 33 outlines the responsibilities and powers of the Lead Overseer in relation to critical ICT third-party service providers. The Lead Overseer is appointed to ensure that these providers comply with comprehensive, sound, and effective rules, procedures, mechanisms, and arrangements to manage ICT risks. This article includes the power to request information, conduct investigations and inspections, issue recommendations, and ensure regular coordination within the Joint Oversight Network (JON).
Article 36 primarily deals with the operational powers and logistics of the Lead Overseer when conducting oversight activities outside the Union. It doesn’t impose compliance requirements directly on the financial entities or third-party service providers themselves but rather outlines the procedures for the Lead Overseer’s oversight functions.
Therefore, this article does not necessitate the creation of control mappings for compliance purposes related to financial entities or third-party service providers.
| DORAÂ Requirements | ISO/IEC 27001:2022 Control | NIST SP 800-53 Control |
| Require critical ICT third-party service providers to provide all necessary information | 5.1 – Policies for information security | AC-2, AC-4 |
| Â | 5.19 – Information security in supplier relationships | SA-9, SA-12 |
| Â | 5.25 – Assessment and decision on information security events | CA-2, CA-7 |
Related to the Lead Overseer’s rights and/or responsibilities
Related to the Lead Overseer’s rights and/or responsibilities
Related to the Lead Overseer’s rights and/or responsibilities
Related to the Lead Overseer’s rights and/or responsibilities
Related to the Lead Overseer’s rights and/or responsibilities
Related to the Lead Overseer’s rights and/or responsibilities
The ESAs shall, through the Joint Committee, submit every five years a joint confidential report to the European Parliament, to the Council and to the Commission, summarising the findings of relevant discussions held with the third countries’ authorities referred to in paragraph 1, focusing on the evolution of ICT third-party risk and the implications for financial stability, market integrity, investor protection and the functioning of the internal
5. Information-sharing arrangements: Chapter VI (Articles 45)
| DORA Requirements | ISO/IEC 27001:2022 Control | NIST SP 800-53 Control |
| Exchange of cyber threat information and intelligence | 5.7 – Threat intelligence | PM-16, CA-2 |
| Â | 5.14 – Information transfer | AU-16, CA-9 |
| Enhancement of digital operational resilience through information sharing | 5.19 – Information security in supplier relationships | PM-11, SR-6 |
| Conduct information-sharing within trusted communities | 5.19 – Information security in supplier relationships | SA-9, SA-12 |
| Protect sensitive nature of shared information and respect business confidentiality | 5.34 – Privacy and protection of personal identifiable information (PII) | PT-2, SI-12 |
| Define conditions for participation in information-sharing arrangements | 5.1 – Policies for information security | PM-1, PM-9 |
| Notify competent authorities of participation in information-sharing arrangements | 5.31 – Legal, statutory, regulatory and contractual requirements | CA-1, CA-2 |
