Financial entities keep the security and operation of ICT systems and tools under continuous monitoring and control and limit ICT risk with security policies, procedures, protocols and tooling designed to keep ICT systems (above all those supporting critical or important functions) resilient and available, and protect data at rest, in use and in transit. The chosen solutions must be appropriate under Article 4 and cover secure data transfer, data loss and corruption, unauthorised access and data management risk. Within the ICT risk management framework they keep an information security policy (covering customer data where applicable), a risk-based network and infrastructure management structure that can cut or segment connections at once, least-privilege access controls, strong authentication and cryptographic key protection, a risk-based ICT change management process approved by management, and documented patch and update policies. Entities listed in Article 16(1) are outside this Article and follow the simplified framework of Article 16 instead.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 114 controls across 18 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-PR.DS-01 The confidentiality, integrity, and availability of data-at-rest are protected
NIST-CSF-PR.IR-01 Networks and environments are protected from unauthorized logical access and usage
NIST-CSF-PR.PS-01 Configuration management practices are established and applied
You are reading one control. How much of DORA have you already done?
DORA DORA-Art.9 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of DORA your existing evidence covers. Hold NIS2 Directive and 17 of 26 DORA controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIS2 Directive pair alone.