DORA DORA-Art.56: Data protection

What else in your programme already covers this

This control maps to 30 controls across 13 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

CCM-DSP-09 Data Protection Impact Assessment
CCM-DSP-11 Personal Data Access, Reversal, Rectification and Deletion
CCM-DSP-12 Limitation of Purpose in Personal Data Processing
CCM-DSP-16 Data Retention and Deletion
CCM-GRC-07 Information System Regulatory Mapping

NIST SP 800-53 Rev 5 · 4 controls

NIST800-PT-2 PT-2 Authority to Process Personally Identifiable Information
NIST800-PT-3 PT-3 Personally Identifiable Information Processing Purposes
NIST800-PT-5 PT-5 Privacy Notice
NIST800-SI-12 SI-12 Information Management and Retention

SOC 2 · 4 controls

SOC2-P1.1 P1.1 Privacy notice to data subjects
SOC2-P3.1 P3.1 Collecting personal information consistent with objectives
SOC2-P4.1 P4.1 Limiting use to identified purposes
SOC2-P4.2 P4.2 Retaining personal information

GDPR · 3 controls

GDPR-Art.32 Security of processing
GDPR-Art.5 Principles relating to processing of personal data
GDPR-Art.6 Lawfulness of processing

C5 (Germany) · 2 controls

C5-COM-01 Identification of applicable legal, regulatory, self-imposed or contractual requirements
C5-INQ-01 Legal Assessment of Investigative Inquiries

CIS Controls v8 · 2 controls

CIS-3.1 Establish and Maintain a Data Management Process
CIS-3.4 Enforce Data Retention

ISO 27001:2022 · 2 controls

5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of personal identifiable information (PII)

ISO 27002:2022 · 2 controls

5.31 Legal, statutory, regulatory and contractual requirements
5.34 Privacy and protection of PII

NIST Cybersecurity Framework 2.0 · 2 controls

NIST-CSF-GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed
NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected

EU AI Act · 1 control

EUAI-Art.59 Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox

FedRAMP High · 1 control

SI-12 Information Management and Retention

FedRAMP Moderate · 1 control

SI-12 Information Management and Retention

NIST SP 800-161 Rev 1 · 1 control

161R1-AC-20 Use of External Systems

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of DORA have you already done?

DORA DORA-Art.56 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of DORA your existing evidence covers. Hold NIS2 Directive and 17 of 26 DORA controls already carry evidence.

If you hold NIS2 Directive65.4% covered · 9 gaps If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.157.7% covered · 11 gaps If you hold ISO 27001:202253.8% covered · 12 gaps If you hold ISO 27002:202253.8% covered · 12 gaps If you hold NIST SP 800-53 Rev 553.8% covered · 12 gaps If you hold NIST Cybersecurity Framework 2.050% covered · 13 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIS2 Directive pair alone.

See the released pairs, $299 each Browse the graph free