Participation in a cybersecurity information-sharing arrangement is voluntary, but telling the regulator about it is not. An entity that enters into such an arrangement must notify the competent authority on entry, and must notify it again on withdrawal once the withdrawal takes effect. The obligation is small and easy to miss precisely because the arrangement itself is optional, and it usually sits with the threat intelligence team rather than with whoever handles regulatory correspondence. Sector information sharing and analysis centres, trusted communities and bilateral exchanges with suppliers can all fall within scope, so the practical requirement is a maintained inventory of arrangements with a notification state against each.
This control maps to 10 controls across 9 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
NIS2 Directive Art.29.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIS2 Directive your existing evidence covers. Hold DORA and 17 of 28 NIS2 Directive controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the DORA pair alone.
The graph holds this control, the 10 it maps to, and the evidence behind each claim, over MCP and REST.