DORA DORA-Art.13: Learning and evolving

What else in your programme already covers this

This control maps to 96 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP Moderate · 9 controls

AT-1 Policy and Procedures
AT-2 Literacy Training and Awareness
AT-3 Role-Based Training
AT-4 Training Records
CA-5 Plan of Action and Milestones
CP-3 Contingency Training
IR-2 Incident Response Training
RA-5 Vulnerability Monitoring and Scanning
RA-7 Risk Response

FedRAMP High · 8 controls

AT-1 Policy and Procedures
AT-2 Literacy Training and Awareness
AT-3 Role-Based Training
AT-4 Training Records
CA-5 Plan of Action and Milestones
CP-3 Contingency Training
IR-2 Incident Response Training
RA-5 Vulnerability Monitoring and Scanning

NIST SP 800-53 Rev 5 LOW · 8 controls

AT-1 Policy and Procedures
AT-2 Literacy Training and Awareness
AT-3 Role-Based Training
AT-4 Training Records
CA-5 Plan of Action and Milestones
CP-3 Contingency Training
IR-2 Incident Response Training
RA-5 Vulnerability Monitoring and Scanning

NIST SP 800-53 Rev 5 MODERATE · 8 controls

AT-1 Policy and Procedures
AT-2 Literacy Training and Awareness
AT-3 Role-Based Training
AT-4 Training Records
CA-5 Plan of Action and Milestones
CP-3 Contingency Training
IR-2 Incident Response Training
RA-5 Vulnerability Monitoring and Scanning

NIST SP 800-53 Revision 5.1 HIGH · 8 controls

AT-1 Policy and Procedures
AT-2 Literacy Training and Awareness
AT-3 Role-Based Training
AT-4 Training Records
CA-5 Plan of Action and Milestones
CP-3 Contingency Training
IR-2 Incident Response Training
RA-5 Vulnerability Monitoring and Scanning

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 6 controls

CCM-A&A-06 Remediation
CCM-HRS-11 Security Awareness Training
CCM-HRS-12 Personal and Sensitive Data Awareness and Training
CCM-SEF-05 Incident Response Metrics
CCM-TVM-01 Threat and Vulnerability Management Policy and Procedures
CCM-TVM-09 Vulnerability Management Reporting

NIS2 Directive · 5 controls

Art.20.2 Train the management body, and offer equivalent training to staff on a regular basis
Art.21.2.b Incident handling
Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure
Art.21.2.g Basic cyber hygiene practices and cybersecurity training
Art.23.4.d Submit a final report within one month, and a progress report where the incident is still running

NIST Cybersecurity Framework 2.0 · 5 controls

NIST-CSF-ID.IM-01 Improvements are identified from evaluations
NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated

NIST SP 800-161 Rev 1 · 5 controls

161R1-AT-2 Literacy Training and Awareness
161R1-AT-3 Role-Based Training
161R1-CP-3 Contingency Training
161R1-IR-2 Incident Response Training
161R1-PM-16 Threat Awareness Program

SOC 2 · 5 controls

SOC2-CC1.4 COSO principle 4: Demonstrates commitment to attract and retain competent individuals
SOC2-CC2.1 COSO principle 13: Obtains and generates relevant, quality information
SOC2-CC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner
SOC2-CC7.1 Detection and monitoring procedures for security events are in place
SOC2-CC7.5 Identifies the root cause of security incidents

C5 (Germany) · 4 controls

C5-DEV-04 Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools
C5-HR-03 Security training and awareness programme
C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept
C5-SIM-05 Evaluation and learning process

CIS Controls v8 · 4 controls

CIS-14.1 Establish and Maintain a Security Awareness Program
CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training
CIS-17.8 Conduct Post-Incident Reviews
CIS-7.1 Establish and Maintain a Vulnerability Management Process

ISO 27001:2022 · 4 controls

5.27 Learning from information security incidents
5.7 Threat intelligence
6.3 Information security awareness, education and training
8.8 Management of technical vulnerabilities

ISO 27002:2022 · 4 controls

5.27 Learning from information security incidents
5.7 Threat intelligence
6.3 Information security awareness, education and training
8.8 Management of technical vulnerabilities

NIST SP 800-53 Rev 5 · 4 controls

NIST800-AT-2 Literacy training and awareness
NIST800-AT-3 Role-based training
NIST800-IR-4 Incident handling
NIST800-RA-5 Vulnerability monitoring and scanning

APRA CPS 230 Operational Risk Management · 3 controls

CPS230-27 Identification and Escalation of Incidents and Near Misses
CPS230-P31 Remediation of Material Operational Risk Weaknesses
CPS230-P45 Annual Update of the Business Continuity Plan

EU AI Act · 3 controls

EUAI-Art.20 Corrective actions and duty of information
EUAI-Art.4 AI literacy
EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies
CFTC-SS-3 Information Security Category

EU Payment Services Directive (PSD2) · 1 control

PSD2-Art.98 Article 98 RTS - SCA + common and secure communication (Commission Delegated Regulation (EU) 2018/389)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.