DORA DORA-Art.30: Key contractual provisions

What else in your programme already covers this

This control maps to 60 controls across 21 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 7 controls

CCM-DSP-05 Data Flow Documentation
CCM-DSP-19 Data Location
CCM-IPY-04 Data Portability Contractual Obligations
CCM-STA-04 SSRM Control Ownership
CCM-STA-09 Primary Service and Contractual Agreement
CCM-STA-10 Supply Chain Agreement Review
CCM-STA-12 Supply Chain Service Agreement Compliance

FedRAMP High · 7 controls

CA-3 Information Exchange
IR-6(3) Incident Reporting | Supply Chain Coordination (IR-6(3))
SA-4 Acquisition Process
SA-9 External System Services
SA-9(2) Identification of Functions, Ports, Protocols, and Services
SR-5 Acquisition Strategies, Tools, and Methods (SR-5)
SR-8 Notification Agreements (SR-8)

FedRAMP Moderate · 7 controls

CA-3 Information Exchange
IR-6(3) Incident Reporting | Supply Chain Coordination (IR-6(3))
SA-4 Acquisition Process
SA-9 External System Services
SA-9(2) Identification of Functions, Ports, Protocols, and Services
SR-5 Acquisition Strategies, Tools, and Methods (SR-5)
SR-8 Notification Agreements (SR-8)

C5 (Germany) · 6 controls

C5-COM-02 Policy for planning and conducting audits
C5-DEV-02 Outsourcing of the development
C5-PI-02 Contractual agreements for the provision of data
C5-PSS-12 Locations of Data Processing and Storage
C5-SSO-04 Monitoring of compliance with requirements
C5-SSO-05 Exit strategy for the receipt of benefits

NIST SP 800-161 Rev 1 · 5 controls

161R1-CA-2 Control Assessments
161R1-IR-7 Incident Response Assistance
161R1-SA-4 Acquisition Process
161R1-SR-5 Acquisition Strategies, Tools, and Methods
161R1-SR-8 Notification Agreements

APRA CPS 230 Operational Risk Management · 4 controls

CPS230-45 APRA Access Provisions in Formal Agreements
CPS230-46 Ongoing Risk Management of Each Material Arrangement
CPS230-50 Formal Agreement Content for Material Arrangements
CPS230-P48 Required Content of the Service Provider Management Policy

NIST Cybersecurity Framework 2.0 · 3 controls

NIST-CSF-GV.SC-02 Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
NIST-CSF-GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
NIST-CSF-GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement

NIST SP 800-53 Rev 5 · 3 controls

NIST800-SA-4 SA-4 Acquisition Process
NIST800-SA-9 SA-9 External System Services
NIST800-SR-8 SR-8 Notification Agreements

SOC 2 · 3 controls

SOC2-CC9.2 CC9.2 Assessing and managing vendor and business partner risk
SOC2-P6.4 P6.4 Privacy commitments from vendors and third parties
SOC2-P6.5 P6.5 Vendor commitments to report unauthorised disclosures

CIS Controls v8 · 2 controls

CIS-15.4 Ensure Service Provider Contracts Include Security Requirements
CIS-15.7 Securely Decommission Service Providers

ISO 27001:2022 · 2 controls

5.20 Addressing information security within supplier agreements
5.23 Information security for use of cloud services

ISO 27002:2022 · 2 controls

5.20 Addressing information security within supplier agreements
5.23 Information security for use of cloud services

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

CFTC-SS-26 Own Resources or Contractual Arrangements to Meet the Recovery Objective

EIOPA Guidelines on ICT Security and Governance (EIOPA-BoS-20/600) · 1 control

EIOPA-ICTSG-GL.25 Outsourcing of ICT services and ICT systems

EU AI Act · 1 control

EUAI-Art.25 Responsibilities along the AI value chain

EU Chips Act (Regulation (EU) 2023/1781) · 1 control

CHIPS-Art.26 Priority-rated orders (Article 26)

EU Cyber Solidarity Act (Regulation (EU) 2025/38) · 1 control

CSA-Art.14_15_16_17 EU Cybersecurity Reserve and trusted providers (Articles 14-17)

EU Markets in Crypto-Assets Regulation (MiCA) · 1 control

MiCA-Art.71_72_73_74 CASP complaints, conflicts, outsourcing and orderly wind-down (Articles 71-74)

EU Payment Services Directive (PSD2) · 1 control

PSD2-Art.19_20 Use of agents and outsourcing rules (PSD2 Articles 19 and 20)

GDPR · 1 control

GDPR-Art.28 Processor

NIS2 Directive · 1 control

Art.21.2.d Supply chain security, covering the relationship with each direct supplier and service provider

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of DORA have you already done?

DORA DORA-Art.30 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of DORA your existing evidence covers. Hold NIS2 Directive and 17 of 26 DORA controls already carry evidence.

If you hold NIS2 Directive65.4% covered · 9 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.157.7% covered · 11 gaps If you hold ISO 27001:202253.8% covered · 12 gaps If you hold ISO 27002:202253.8% covered · 12 gaps If you hold NIST SP 800-53 Rev 553.8% covered · 12 gaps If you hold NIST Cybersecurity Framework 2.050% covered · 13 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIS2 Directive pair alone.

See the released pairs, $299 each Browse the graph free