DORA
DORA Chapter II: ICT Risk Management

DORA DORA-Art.13: Learning and evolving

Financial entities have the capability and staff to gather and analyse information on vulnerabilities, cyber threats and ICT-related incidents; after a major incident disrupts core activities they run a post-incident review that checks whether procedures were followed and actions worked (alert response speed, forensic quality where appropriate, escalation, communication); they feed lessons from testing, real incidents and plan activations into ICT risk assessment, monitor the resilience strategy and incident trends, have senior ICT staff report findings to the management body at least yearly, and run compulsory ICT security awareness and resilience training for all staff and senior management, including ICT third-party providers where appropriate. Entities other than microenterprises must also tell the authority, on request, what changed after post-incident reviews (Art. 13(2)) and track technological developments continuously for their security impact (Art. 13(7)). Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 72 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP Moderate · 9 controls

  • AT-1 Policy and Procedures
  • AT-2 Literacy Training and Awareness
  • AT-3 Role-Based Training
  • AT-4 Training Records
  • CA-5 Plan of Action and Milestones
  • CP-3 Contingency Training
  • IR-2 Incident Response Training
  • RA-5 Vulnerability Monitoring and Scanning
  • RA-7 Risk Response

FedRAMP High · 8 controls

  • AT-1 Policy and Procedures
  • AT-2 Literacy Training and Awareness
  • AT-3 Role-Based Training
  • AT-4 Training Records
  • CA-5 Plan of Action and Milestones
  • CP-3 Contingency Training
  • IR-2 Incident Response Training
  • RA-5 Vulnerability Monitoring and Scanning

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 6 controls

NIS2 Directive · 5 controls

  • Art.20.2 Train the management body, and offer equivalent training to staff on a regular basis
  • Art.21.2.b Incident handling
  • Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure
  • Art.21.2.g Basic cyber hygiene practices and cybersecurity training
  • Art.23.4.d Submit a final report within one month, and a progress report where the incident is still running

NIST Cybersecurity Framework 2.0 · 5 controls

  • NIST-CSF-ID.IM-01 Improvements are identified from evaluations
  • NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
  • NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
  • NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated

NIST SP 800-161 Rev 1 · 5 controls

SOC 2 · 5 controls

  • SOC2-CC1.4 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
  • SOC2-CC2.1 CC2.1 Relevant, quality information to support internal control (COSO principle 13)
  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  • SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities
  • SOC2-CC7.5 CC7.5 Recovering from security incidents

C5 (Germany) · 4 controls

  • C5-DEV-04 Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools
  • C5-HR-03 Security training and awareness programme
  • C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept
  • C5-SIM-05 Evaluation and learning process

CIS Controls v8 · 4 controls

  • CIS-14.1 Establish and Maintain a Security Awareness Program
  • CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training
  • CIS-17.8 Conduct Post-Incident Reviews
  • CIS-7.1 Establish and Maintain a Vulnerability Management Process

ISO 27001:2022 · 4 controls

  • 5.27 Learning from information security incidents
  • 5.7 Threat intelligence
  • 6.3 Information security awareness, education and training
  • 8.8 Management of technical vulnerabilities

ISO 27002:2022 · 4 controls

  • 5.27 Learning from information security incidents
  • 5.7 Threat intelligence
  • 6.3 Information security awareness, education and training
  • 8.8 Management of technical vulnerabilities

NIST SP 800-53 Rev 5 · 4 controls

APRA CPS 230 Operational Risk Management · 3 controls

  • CPS230-27 Identification and Escalation of Incidents and Near Misses
  • CPS230-P31 Remediation of Material Operational Risk Weaknesses
  • CPS230-P45 Annual Update of the Business Continuity Plan

EU AI Act · 3 controls

  • EUAI-Art.20 Corrective actions and duty of information
  • EUAI-Art.4 AI literacy
  • EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

  • CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies
  • CFTC-SS-3 Information Security Category

EU Payment Services Directive (PSD2) · 1 control

  • PSD2-Art.98 Article 98 RTS - SCA + common and secure communication (Commission Delegated Regulation (EU) 2018/389)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in DORA Chapter II: ICT Risk Management

You are reading one control. How much of DORA have you already done?

DORA DORA-Art.13 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of DORA your existing evidence covers. Hold NIS2 Directive and 17 of 26 DORA controls already carry evidence.

If you hold NIS2 Directive65.4% covered · 9 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.157.7% covered · 11 gapsIf you hold ISO 27001:202253.8% covered · 12 gapsIf you hold ISO 27002:202253.8% covered · 12 gapsIf you hold NIST SP 800-53 Rev 553.8% covered · 12 gapsIf you hold NIST Cybersecurity Framework 2.050% covered · 13 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIS2 Directive pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 72 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll DORA controls